← methodology

OAuth protected resource metadata

usability.oauth-pr-metadata · Usability · 2 pts · recommended

Goal

Can an agent authenticate to you?

Whether agents can discover your auth model machine-readably (OAuth metadata) and follow documented steps to credentials.

How we test

Fetched /.well-known/oauth-protected-resource.

How to pass

Serve RFC 9728 protected-resource metadata naming your authorization servers so agents can discover how to authenticate.

Spec

https://www.rfc-editor.org/rfc/rfc9728 ↗

Verify a fix

curl -X POST /api/scan/checks \
  -H 'content-type: application/json' \
  -d '{"url": "yourdomain.com", "checkIds": ["usability.oauth-pr-metadata"]}'