Function: protectedResourceMetadataPaths()

protectedResourceMetadataPaths(args): string[]

Defined in: protectedResourceMetadata.ts:94

Every request path the document must be served at for a given resource, most specific first.

RFC 9728 §3.1 derives the metadata URL by inserting the well-known segment between the host and the path of the resource identifier — so https://host/mcp is discovered at https://host/.well-known/oauth-protected-resource/mcp, not at https://host/mcp/.well-known/… and not only at the root. Serving only the root makes a client that applies the derivation rule fail discovery outright.

The root is returned as well, because clients that follow the resource_metadata value in WWW-Authenticate (rather than deriving) have historically been pointed there — and a resource with no path derives the root anyway, which is why the list is de-duplicated.

Parameters

Parameter	Type	Description
args	{ resource: string; }	-
args.resource	string	The resource identifier the document describes.

Returns

string[]

Example

protectedResourceMetadataPaths({ resource: 'https://host/mcp' });
// => ['/.well-known/oauth-protected-resource/mcp',
//     '/.well-known/oauth-protected-resource']

protectedResourceMetadataPaths({ resource: 'https://host' });
// => ['/.well-known/oauth-protected-resource']