# Get protected resource metadata

> Returns the [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) Protected Resource Metadata

<Heading
  as={"h1"}
  className={"openapi__heading"}
  children={"Get protected resource metadata"}
>
</Heading>

<MethodEndpoint
  method={"get"}
  path={"/.well-known/oauth-protected-resource"}
  context={"endpoint"}
>
  
</MethodEndpoint>

Returns the [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) Protected Resource Metadata
document, naming the authorization server that guards `/mcp`. An unauthenticated request to
`/mcp` answers `401` with a `WWW-Authenticate: Bearer resource_metadata="…"` header pointing
here, which is how an OAuth-aware MCP client bootstraps the flow.

<ParamsDetails>
  
</ParamsDetails>

<RequestSchema
  {...require("./get-oauth-protected-resource-metadata.RequestSchema.json")}
>
  
</RequestSchema>

<StatusCodes
  {...require("./get-oauth-protected-resource-metadata.StatusCodes.json")}
>
  
</StatusCodes>