Protected resource metadata generator
Fill the fields below. Copy JSON, challenge header, and Pages headers — nothing is uploaded.
HTTPS URL with no fragment. Paths are allowed — they change the well-known location (RFC 9728 §3.1).
Each value should be an AS issuer identifier (HTTPS). Leave empty only if you intentionally omit authorization_servers.
RFC values: header, body, query. MCP-style APIs almost always want header.
Well-known URL
WWW-Authenticate
PRM JSON
Cloudflare Pages _headers recipe
Serve the extensionless well-known file as application/json on the resource origin.
Why this tool exists
RFC 9728 lets a protected resource advertise which authorization servers may issue tokens for it. MCP and modern APIs often return a 401 with resource_metadata pointing at that document. Easy mistakes: wrong path insertion, resource not identical to the identifier, or serving HTML with status 200. This page builds the pack locally. Need steps? See the how-to or use cases.