Discovery

OAuth protected-resource metadata (RFC 9728) that MCP clients read after a 401.

Base URL, authentication and conventions of this API are on the MCP Connector API page.

Endpoints

get/.well-known/oauth-protected-resourceGet protected-resource metadata
get/.well-known/oauth-protected-resource/{resource}Get metadata for a resource path

get/.well-known/oauth-protected-resource

Get protected-resource metadata

RFC 9728 metadata. resource is the root URL of the host you called; authorization_servers points to Nucleo Core, whose /.well-known/oauth-authorization-server lists the registration, authorization and token endpoints. Cacheable for 5 minutes.

GET https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource

Authentication: None — public endpoint

Responses

200Metadata.application/json
Headers
- Cache-Control
- resourcestring (uri)required
- authorization_serversarray of string (uri)required
- bearer_methods_supportedarray of string
  One ofheader
- scopes_supportedarray of string
- resource_namestring

Request

curl -X GET https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource \
  -H 'Accept: application/json'

const res = await fetch("https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource", {
  method: "GET",
  headers: {
    Accept: "application/json",
  },
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('GET', 'https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource', [
    'headers' => [
        'Accept' => 'application/json',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "resource": "https://mcp.nucleoplatform.com",
  "authorization_servers": [
    "https://auth.nucleoplatform.com"
  ],
  "bearer_methods_supported": [
    "header"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email"
  ],
  "resource_name": "Nucleo"
}

get/.well-known/oauth-protected-resource/{resource}

Get metadata for a resource path

Path-suffixed variant some clients request (e.g. /.well-known/oauth-protected-resource/mcp). Same document as the root variant.

GET https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource/{resource}

Authentication: None — public endpoint

Path parameters

resourcestringrequired
Example: mcp

Responses

200Metadata.application/json
- resourcestring (uri)required
- authorization_serversarray of string (uri)required
- bearer_methods_supportedarray of string
  One ofheader
- scopes_supportedarray of string
- resource_namestring

Request

curl -X GET https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource/mcp \
  -H 'Accept: application/json'

const res = await fetch("https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource/mcp", {
  method: "GET",
  headers: {
    Accept: "application/json",
  },
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('GET', 'https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource/mcp', [
    'headers' => [
        'Accept' => 'application/json',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "resource": "https://shop.acme.example",
  "authorization_servers": [
    "https://shop.acme.example"
  ],
  "bearer_methods_supported": [
    "header"
  ],
  "scopes_supported": [
    "string"
  ],
  "resource_name": "string"
}

Was this page helpful?