OAuth protected resource metadata for the MCP endpoint
package main
import ( "fmt" "net/http" "io")
func main() {
url := "https://api.ai.wpengine.com/.well-known/oauth-protected-resource/v1/mcp"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close() body, _ := io.ReadAll(res.Body)
fmt.Println(res) fmt.Println(string(body))
}const url = 'https://api.ai.wpengine.com/.well-known/oauth-protected-resource/v1/mcp';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}<?php
$client = new \GuzzleHttp\Client();
$response = $client->request('GET', 'https://api.ai.wpengine.com/.well-known/oauth-protected-resource/v1/mcp');
echo $response->getBody();curl --request GET \ --url https://api.ai.wpengine.com/.well-known/oauth-protected-resource/v1/mcpOAuth 2.0 Protected Resource Metadata (RFC 9728) for /v1/mcp, naming the authorization server an MCP client obtains an access token from. This is the discovery entry point for interactive OAuth sign-in: an MCP client that calls /v1/mcp without a credential receives 401 with a WWW-Authenticate: Bearer resource_metadata="..." challenge pointing at this document.
The resource value is the canonical URI of the MCP endpoint, and is the value a client must send as the RFC 8707 resource parameter on its authorization and token requests. A token is accepted at /v1/mcp only when its aud claim is that same URI.
No credential is required, and the response is readable from any origin. No scopes_supported is published: no scope beyond sign-in is required at this endpoint.
Responses
Section titled “Responses”The protected resource metadata document.
OAuth 2.0 Protected Resource Metadata (RFC 9728 §2) for the MCP endpoint. Fields not listed here are omitted; a client must ignore members it does not understand.
object
The canonical URI of the MCP endpoint. A client must discard this document if the value is not identical to the URL it requested the MCP endpoint at (RFC 9728 §3.3).
Issuer identifiers of the authorization servers that issue access tokens for this resource. A client discovers each one’s endpoints from its own metadata document (RFC 8414).
How an access token may be presented. Only the Authorization request header is supported.
Example
{ "resource": "https://api.wpengineapi.com/v1/mcp", "bearer_methods_supported": [ "header" ]}This deployment does not accept interactive OAuth sign-in at the MCP endpoint. API key and Okta authentication are unaffected.
The document is read-only; use GET or HEAD.