Function: getWwwAuthenticateHeader()
getWwwAuthenticateHeader(
args):string
Defined in: oauthServer.ts:485
Returns the WWW-Authenticate header value for a 401 response on a protected
resource, advertising the RFC 9728 resource-metadata URL so OAuth/MCP clients
can bootstrap discovery.
The URL comes from protectedResourceMetadataUrl, which applies
RFC 9728 §3.1's derivation — the well-known segment goes between the
host and the resource's path. A resource with no path is unaffected; one
with a path previously produced <resource>/.well-known/…, a location the
spec does not define and no server here serves.
Parameters
| Parameter | Type | Description |
|---|---|---|
args | { resource: string; } | - |
args.resource | string | The resource identifier. The metadata URL is derived from it per RFC 9728 §3.1. |
Returns
string
Example
getWwwAuthenticateHeader({ resource: 'https://mcp.example.com' });
// => 'Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"'
getWwwAuthenticateHeader({ resource: 'https://mcp.example.com/mcp' });
// => 'Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/mcp"'