Publish OAuth protected-resource metadata
const url = 'https://example.com/.well-known/oauth-protected-resource';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/.well-known/oauth-protected-resourceRFC 9728 metadata binds this exact Evidence resource origin to one authorization-server issuer, the Evidence response JWKS, and header-only bearer transport. It contains no requester-scoped or operator-private configuration.
Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”The exact strong entity tag from a prior response.
Responses
Section titled “Responses”OAuth protected-resource metadata
object
Example
{ "bearer_methods_supported": [ "header" ]}Headers
Section titled “Headers”Public metadata may be cached for at most ten minutes.
Strong SHA-256 entity tag over the exact response bytes.
Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.
The protected-resource metadata is unchanged
Headers
Section titled “Headers”Public metadata may be cached for at most ten minutes.
Strong SHA-256 entity tag over the exact response bytes.
Effective W3C trace context. One valid inbound traceparent is retained; missing, invalid, or duplicate values are replaced and tracestate is never reflected.