Agent readiness check
OAuth protected resource metadata is published
A site whose API needs credentials publishes /.well-known/oauth-protected-resource naming the resource and its authorization servers.
low severityagents.oauth-protected-resource
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
Protected resource metadata (RFC 9728) is how an agent learns, from the API itself, which authorization server issues tokens for it and with which scopes.
How to fix it
If your API needs credentials, publish /.well-known/oauth-protected-resource with resource, authorization_servers and scopes_supported.
The details
- Category
- Agent readiness
- Severity of a failure
- low
- Confidence
- high
- Needs a browser
- No
- Check id
- agents.oauth-protected-resource