OAuth Protected Resource Metadata Support

What problem does it solve?

OAuth-protected APIs need accurate, discoverable metadata so clients and agents can request the correct authorization scopes and handle authentication prompts correctly, without guessing or hardcoding provider details.

Core Features & Use Cases

• Metadata endpoint discovery: Provides a hosted .well-known endpoint that returns published resource metadata for Orquestra’s protected API surfaces.
• OAuth configuration fields: Publishes resource, authorization_servers, scopes_supported, bearer_methods_supported, and resource_documentation to help clients form valid authorization requests.
• WWW-Authenticate guidance: Protected endpoints return WWW-Authenticate headers containing a resource_metadata pointer so clients know where to fetch the right metadata automatically.

Quick Start

Ask your AI agent to fetch the OAuth protected resource metadata from https://api.orquestra.dev/.well-known/oauth-protected-resource and then use the returned scopes_supported to request access for the protected endpoints.