OAUTH / PRM

Publish OAuth protected-resource discovery — then host it yourself.

For API and MCP teams that need clients to find the right authorization servers. Fill your resource URL once, get paste-ready metadata JSON, the correct well-known path, a 401 WWW-Authenticate line, and Pages headers — all in your browser, nothing uploaded.

Start tool Runs in your browser · nothing uploaded

One form → four artifacts

JSON metadata, derived well-known URL, Bearer challenge header, and a Content-Type recipe. No signup.

Local only

Resource URLs and scopes never leave this tab. We never ask for client secrets or private keys.

Guides that match the tool

How-to, FAQ, and publish scenarios sit next to the generator so you can ship without guessing path rules.

Open the generator

Enter resource URL + authorization servers + scopes. Copy, download, deploy.

How to publish

Eight executable steps: path insertion, resource match, 401 challenge, curl check.

Use cases

MCP HTTP server, multi-tenant API path, and docs golden pack.

FAQ

What this is not, path insertion, signed metadata boundary, privacy.
What the pack contains (for implementers)
  1. PRM JSON — RFC 9728 document with resource, authorization_servers, optional scopes and bearer methods.
  2. Well-known URL — derived with path insertion so https://api.example/mcp becomes /.well-known/oauth-protected-resource/mcp.
  3. WWW-Authenticate — Bearer resource_metadata="…" challenge for unauthenticated requests.
  4. Pages _headers — serve the extensionless file as application/json.

This is not an Authorization Server, not Dynamic Client Registration, and not a live metadata validator for URLs you already published. Host the files on your resource origin.