Skip to main content

Function: protectedResourceMetadataUrl()

protectedResourceMetadataUrl(args): string

Defined in: protectedResourceMetadata.ts:129

The absolute URL a spec-following client derives for a resource — the first entry of protectedResourceMetadataPaths, resolved against the resource's own origin. This is the value to advertise in WWW-Authenticate: Bearer resource_metadata="…".

Throws when resource is not an absolute URL, unlike protectedResourceMetadataPaths, which falls back to the root. The asymmetry is deliberate: a path is matched against incoming requests, so tolerating a bad value costs a wrong route at worst and must not crash route registration — whereas this value is handed to clients in a response header, where an unparseable URL is a dead end the client cannot work around and nobody operating the server would see. Fail at wiring time instead.

Parameters

ParameterTypeDescription
args{ resource: string; }-
args.resourcestringThe resource identifier the document describes. Must be an absolute URL.

Returns

string

Throws

when resource is not an absolute URL.

Example

protectedResourceMetadataUrl({ resource: 'https://host/mcp' });
// => 'https://host/.well-known/oauth-protected-resource/mcp'