Cross Domain · specification · IETF — OAuth working group, Standards Track
OAuth 2.0 Protected Resource Metadata (RFC 9728)
RFC 9728 is the Standards Track specification that lets an API describe how it is protected, in a JSON document served at /.well-known/oauth-protected-resource. It carries the resource identifier, which authorization servers issue tokens for it, supported scopes, accepted bearer methods, and whether tokens must be DPoP- or certificate-bound. A WWW-Authenticate challenge can point at it with the resource_metadata parameter, so a client that gets a 401 can discover where to go without being configured in advance.
www.rfc-editor.org/rfc/rfc9728....The standard
IETF — OAuth working group, Standards TrackGoverning body
2025First published
RFC 9728 (April 2025)Current version
Yes — a defined JSON metadata documen...Machine-readable schema · open
4049measured implementing it
0tagged with it
Also known as RFC 9728, Protected Resource Metadata, PRM, oauth-protected-resource.
Measured implementing OAuth 2.0 Protected Resource Metadata 4049
These providers were observed, not self-declared: they serve /.well-known/oauth-protected-resource (RFC 9728): verified names its authorization_servers, documented carries `resource` only. Read from each provider's Kin Score agent-readiness grade. The top 300 of 4049 are shown.
verified · 3966documented · 83
APIs.ioverifiedHubSpotverifiedSalesforceverifiedTray.aiverifiedHarnessverifiedMicrosoft Entra ID (formerly Azure AD)verifiedZoomInfoverifiedCustomer.ioverifiedInfobipverifiedLaunchDarklyverifiedGitHubverifiedAirwallexverifiedJobsPipeverifiedAppwriteverifiedShopifyverifiedAfterShipverifiedCDataverifiedPostmanverifiedElevenLabsverifiedGitHub ActionsverifiedCloudflareverifiedJiraverifiedBrevoverifiedGainsightverifiedLeadpingverifiedDatadog APMverifiedStripeverifiedRelevance AIverifiedSentryverifiedSalesforce Marketing CloudverifiedThousandEyesverifiedAlgoliaverifiedCanvaverifiedGreenhouseverifiedGitLabverifiedKitverifiedXquikverifiedBoom AiverifiedSMKlogverifiedFlagsmithverifiedLucidverifiedStediverifiedTelnyxverifiedDatadogverifiedOutreachverifiedRecurlyverifiedBugsnagverifiedRudderStackverifiedCloseverifiedConfluenceverifiedOktaverifiedOneSignalverifiedUpstoxverifiedEsriverifiedMongoDBverifiedOptimizelyverifiedKlaviyoverifiedAirbyteverifiedMedplumverifiedSurfeverifiedAct-OnverifiedChecklyverifiedClickHouseverifiedCarsXEverifiedDrippayverifiedOmnisendverifiedStatsigverifiedLoopsverifiedNew RelicverifiedAdobeverifiedLosantverifiedSquareverifiedlemlistverifiedAembitverifiedMiraklverifiedAtlassian CompassverifiedPauboxverified0xArchiveverifiedBrazeverifiedEventwrenverifiedSigma ComputingverifiedCoda ProjectverifiedMapp Marketing CloudverifiedAsanaverifiedXverifiedSeismicverifiedUnifyverifiedBloomreachverifiedFellowverifiedFlexpaverifiedScope3verifiedbeehiivverifiedBitlyverifiedClickupverifiedHagglebeeverifiedMergeverifiedYarnhenverifiedYawpletverifiedDataForSEOverifiedPrismaverifiedSalesforce Service Cloud APIsverifiedLeadspaceverifiedTextQLverifiedQontoverifiedCracked APIverifiedCurlecverifiedCognyverifiedContext.devverifiedDash0verifiedBigPandaverifiedNetlifyverifiedPrismicverifiedRegalverifiedFireflies.aiverifiedLightfieldverifiedBrowser UseverifiedGitHub CopilotverifiedMoovverifiedDoiTverifiedDustverifiedG2verifiedImprovadoverifiedUserGemsverifiedAdobe WorkfrontverifiedKongverifiedLushaverifiedShortcut SoftwareverifiedZapierverifiedZuploverifiedFacebook Business ManagerverifiedUnbounceverifiedImpactverifiedHunterverifiedAskNicelyverifiedMemo BankverifiedMonte CarloverifiedKontakt.ioverifiedProfoundverifiedTapfiliateverifiedCloudBeesverifiedDiditverifiedMailerLiteverifiedCongaverifiedDemandbaseverifiedDevCycleverifiedFrontAppverifiedNovuverifiedAlphaAIverifiedTranscriptFetchverifiedDrataverifiedSpeakeasyverifiedBuildkiteverifiedJotformverifiedMicrosoft OutlookverifiedNorthbeamverifiedBirdeyeverifiedFLORAverifiedBigCommerceverifiedLiliverifiedLiltverified6senseverifiedBetter StackverifiedCoresignalverifiedMicrosoft Dynamics 365 Business CentralverifiedSnov.ioverifiedApollo.ioverifiedCohesityverifiedLacunaverifiedMedusaverifiedAlpacaverifiedRybbitverifiedVirix LabsverifiedArchbeeverifiedThe ColonyverifiedAgorapulseverifiedBrand API (Brandfetch)verifiedMOLOCOverifiedStatable Stats APIverifiedTriple WhaleverifiedAppLike GroupverifiedBrowserStackverifiedParallelverifiedPerkverifiedStayingAPIverifiedWappalyzerverifiedZoom PhoneverifiedDelxverifiedGivebutterverifiedHightouchverifiedIntegrationOSverifiedKnakverifiedChili PiperverifiedEmbraceverifiedRocketReachverifiedTaskfolkverifiedAirtableverifiedNutshellverifiedWorkatoverifiedCircleCIverifiedeClinicalWorksverifiedBoomiverifiedDremio | Intelligent Lakehouse PlatformverifiedExtoleverifiedRoutebaseverifiedShowpadverifiedDID LogicverifiedInstantlyverifiedOracleverifiedDeliverdverifiedMoEngageverifiedRhombus SystemsverifiedZillapiverifiedAcceldataverifiedAPI EvangelistverifiedAPILayerverifiedDeBounceverifiedNatural AIverifiedPlatform.shverifiedBriaverifiedMollieverifiedPrezentverifiedTwelve DataverifiedClayverifiedPostizverifiedTradeshiftverifiedAhrefsverifiedcPanelverifiedFamaverifiedInflection.ioverifiedFeedlyverifiedAdobe AnalyticsverifiedLevverifiedResolveverifiedDeveloperHubverifiedCrevioverifiedFlintverifiedIntelligemsverifiedPexafyverifiedSingularverifiedCommon RoomverifiedAdobe Experience CloudverifiedNotionverifiedBufferverifiedUsersnapverifiedSeamless.AIverifiedDivvyverifiedAstrology APIverifiedRoboflowverifiedBucketverifiedCalicoverifiedVismaverifiedCI HUBverifiedCvent Hospitality CloudverifiedDeputyverifiedDuvo AiverifiedGongverifiedGrafana LokiverifiedPlayableverifiedDescopeverifiedUpsunverified1LookupverifiedDomScanverifiedNexlaverifiedBraleverifiedPluralsightverifiedAiriaverifiedMicrosoft WordverifiedPerplexityverifiedSnapchatverifiedAzure PipelinesverifiedEntergramverifiedfalverifiedFigmaverifiedOpenworkverifiedBoxverifiedFullEnrichverifiedSynupverifiedBufverifiedGumloopverifiedLightrunverifiedNimblewayverifiedOnfleetverifiedSyft DataverifiedGraviteeverifiedThe Mobile First CompanyverifiedTradingViewverifiedHexverifiedMedblocksverifiedQuickbaseverifiedSequelverifiedSimilarWebverifiedHuntressverifiedAIMLAPIverifiedFirstPromoterverifiedMeltwaterverifiedAnyAPIverifiedAppchargeverifiedCollateverifiedAgentMailverifiedCleverTapverified
Providers that carry OAuth 2.0 Protected Resource Metadata 0
No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements OAuth 2.0 Protected Resource Metadata and says so in its APIs.json profile appears here on the next build. Add or correct a listing.
Read from the API Evangelist standards directory, facts verified 2026-08-24. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.