Protected Resource Metadata

draft-ietf-oauth-resource-metadata: serves the /.well-known/oauth-protected-resource document so RFC 9728 clients can auto-discover which authorization servers issue tokens for this resource, what scopes the resource accepts, what dpop algorithms the resource verifies, and which bearer- method binding (DPoP / mTLS cnf claim) is required. Pairs with b.middleware.bearerAuth so a 401 from the protected resource includes WWW-Authenticate: Bearer resource_metadata= and the client can self-rediscover.

b.middleware.protectedResourceMetadata(opts) #

{
  {
    resource:                       string,        // canonical resource URI (required)
    authorizationServers:           string[],      // issuer URLs that mint tokens for this resource (required, ≥1)
    scopesSupported?:               string[],
    bearerMethodsSupported?:        ("header"|"body"|"query")[],   // default ["header"]
    resourceSigningAlgValuesSupported?: string[], // for signed introspection / jwt-secured responses
    resourceDocumentation?:         string,        // URL to operator docs
    resourcePolicyUri?:             string,
    resourceTosUri?:                string,
    dpopSigningAlgValuesSupported?: string[],
    dpopBoundAccessTokensRequired?: boolean,
    mtlsBoundAccessTokensRequired?: boolean,
    path?:                          string,        // default "/.well-known/oauth-protected-resource"
  }
}

Returns a request middleware that serves the protected-resource metadata JSON document at /.well-known/oauth-protected-resource (or operator-overridden path).

var mw = b.middleware.protectedResourceMetadata({
  resource:             "https://api.example.com",
  authorizationServers: ["https://idp.example.com"],
  scopesSupported:      ["read", "write"],
  dpopBoundAccessTokensRequired: true,
});
app.use(mw);

Last updated 2026-08-08T16:39:49.652Z by seeder.