agent-ready-oauth-protected-resource

OAuth Protected Resource Metadata is a standardized JSON endpoint that lets AI agents discover authentication requirements. It advertises the authorization server and supported scopes so agents can automatically access protected resources.

To publish RFC 9728 metadata, configure a JSON endpoint at the standardized well-known path on your Cloudflare Worker. Include the resource identifier and authorization server array to enable agent discovery.

Yes, Cloudflare Access integrates with OAuth Protected Resource Metadata. You can implement the well-known endpoint on Cloudflare Workers to expose authorization server configuration and scopes for agent-ready authentication.

You validate OAuth Protected Resource Metadata by scanning the deployed website. The scan verifies that the well-known endpoint serves valid JSON containing the required resource identifier and authorization server fields.

Required OAuth Protected Resource Metadata fields include a resource identifier and an authorization server array. Optional fields include supported scopes and references to resource metadata from unauthorized responses.

AI agent authentication fails when the protected resource lacks RFC 9728 metadata. Serving valid OAuth Protected Resource Metadata at the well-known endpoint allows agents to discover the authorization server and required scopes.