OAuth protected resource metadata FAQ

Is this an Authorization Server or login product?

No. Okta, Auth0, Keycloak, and Cognito issue tokens. This site only helps a resource server publish RFC 9728 discovery metadata and a matching 401 challenge snippet. It never runs an AS, never stores users, and never mints access tokens.

Why does my well-known path include /mcp (or another path)?

RFC 9728 inserts /.well-known/oauth-protected-resource between the host and the resource path. If your resource identifier is https://api.example.com/mcp, clients fetch https://api.example.com/.well-known/oauth-protected-resource/mcp. Publishing only at the host root is wrong when the identifier has a path — multi-tenant and MCP setups rely on this rule.

What happens if resource does not match the identifier?

Clients MUST ignore the document. Trailing slashes, http vs https, and accidental ports all count as mismatches. The generator warns when it can detect an unsafe identifier; you still must keep production JSON identical to the live resource URL clients call.

Do I need signed_metadata?

Unsigned metadata protected by TLS is the common starting point. Signed metadata (JWT) is optional and out of scope for this static pack. If you need signed bundles, sign offline with your own keys — this tool never asks for private keys.

How is this different from a live validator like authmeta?

Validators fetch a URL you already published and check it. This generator builds the files before publish, including Pages Content-Type recipes and the WWW-Authenticate line. Use both: generate here, deploy, then validate live if you want.

Do private keys or tokens go through this site?

No. The generator never asks for private keys, client secrets, or access tokens. URLs and scopes stay in your browser; downloads are produced locally. Cloudflare may log ordinary page-view CDN data (IP, URL path) for this static site — not the contents of the form fields. Details: Privacy.