Handling Protected Resource Metadata Discovery for Auth for MCP With Auth0
Last Updated:
Overview
When implementing Auth for Model Context Protocol (MCP) with Auth0, Protected Resource Metadata (PRM) discovery must be handled by the resource server rather than Auth0. The application must host the specific well-known endpoints to provide the required JSON response containing the resource metadata.
Applies To
- Auth0
- Auth for Model Context Protocol (MCP)
- Protected Resource Metadata (PRM)
Solution
How is Protected Resource Metadata discovery handled by the resource server?
Implement Protected Resource Metadata discovery by configuring the application to host the required well-known endpoints and return the appropriate JSON response.
- Host the primary endpoint
/.well-known/oauth-protected-resource/mcpon the application server. - Host the fallback endpoint
/.well-known/oauth-protected-resourceon the application server. - Configure the endpoints to return a JSON response containing the resource metadata.
Review the following JSON example to understand the required structure for the endpoint response.
{
"scopes_supported": ["files:read", "files:write"],
}
Review the full list of possible parameters used by RFC 9728 §3.3 in the RFC 9728 §3.3: Protected Resource Metadata documentation.
