skills.rest
berkayoztunc
berkayoztuncCOMMUNITY
Explore all skills by this author →
Website𝕏@whitemoondevGitHub

OAuth Protected Resource Metadata Support

Publish OAuth protected resource metadata via a .well-known endpoint and WWW-Authenticate headers.

21|1|Updated Feb 20, 2026
Search Tags:#oauth#openid connect#well-known#agent authentication#authorization scopes#resource metadata
One-click install
npx skills add https://github.com/berkayoztunc/orquestra --skill oauth-protected-resource-metadata-support
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: OAuth Protected Resource Metadata Support
Source: https://github.com/berkayoztunc/orquestra/tree/main/packages/frontend/assets/.well-known/agent-skills/oauth-protected-resource
Command: npx skills add https://github.com/berkayoztunc/orquestra --skill oauth-protected-resource-metadata-support

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve?

OAuth-protected APIs need accurate, discoverable metadata so clients and agents can request the correct authorization scopes and handle authentication prompts correctly, without guessing or hardcoding provider details.

Core Features & Use Cases

  • Metadata endpoint discovery: Provides a hosted .well-known endpoint that returns published resource metadata for Orquestra’s protected API surfaces.
  • OAuth configuration fields: Publishes resource, authorization_servers, scopes_supported, bearer_methods_supported, and resource_documentation to help clients form valid authorization requests.
  • WWW-Authenticate guidance: Protected endpoints return WWW-Authenticate headers containing a resource_metadata pointer so clients know where to fetch the right metadata automatically.

Quick Start

Ask your AI agent to fetch the OAuth protected resource metadata from https://api.orquestra.dev/.well-known/oauth-protected-resource and then use the returned scopes_supported to request access for the protected endpoints.

Frequently Asked Questions about OAuth Protected Resource Metadata Support

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is OAuth protected resource metadata and why do I need it for agent authentication?▼

OAuth protected resource metadata supplies clients and agents with discoverable details like scopes and authorization servers, eliminating the need to hardcode provider specifics when accessing protected API endpoints. It ensures agents request valid authentication parameters automatically.

How do I discover OAuth scopes supported by a protected API endpoint?▼

You can fetch the published OAuth scopes by retrieving the .well-known metadata document from the protected resource endpoint, which returns the scopes_supported field. Protected endpoints also provide a resource_metadata pointer via WWW-Authenticate headers for automatic discovery.

How does the WWW-Authenticate header help clients find OAuth resource metadata?▼

The WWW-Authenticate header includes a resource_metadata pointer that directs clients to the exact URL for fetching the correct OAuth configuration. This allows automated OAuth clients to dynamically discover required scopes and bearer methods without manual configuration.

Can I use this OAuth metadata endpoint for API gateway handshakes and automated agent integrations?▼

Yes, the published OAuth resource metadata is designed for agent integrations, API gateway handshakes, and automated OAuth configuration. It exposes fields like authorization_servers and bearer_methods_supported to help clients form valid authorization requests for protected endpoints.

What configuration fields are exposed in the .well-known OAuth protected resource document?▼

The .well-known document exposes resource, authorization_servers, scopes_supported, bearer_methods_supported, and resource_documentation fields. These fields provide the necessary details for OAuth clients to construct valid authorization requests for protected API surfaces.

Related Skills

Explore More Software Engineering Skills→
novvoonovvoo

oauth

Implement OAuth 2.0/2.1 authorization flows in Fastify applications.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

mcp-client-protected-resource-metadata

Parse OAuth 2.0 Protected Resource Metadata for MCP client authorization server discovery.

Official
Intermediate
scalekit-incscalekit-inc

adding-mcp-oauth

Automate adding OAuth 2.1 authorization to MCP servers with Scalekit.

Official
Advanced
fabricioctellesfabricioctelles
47

agent-ready-oauth-protected-resource

Publish RFC 9728 OAuth Protected Resource Metadata for Cloudflare Workers.

Community
Basic