Cross Domain · specification · IETF — OAuth working group, Standards Track

OAuth 2.0 Protected Resource Metadata (RFC 9728)

RFC 9728 is the Standards Track specification that lets an API describe how it is protected, in a JSON document served at /.well-known/oauth-protected-resource. It carries the resource identifier, which authorization servers issue tokens for it, supported scopes, accepted bearer methods, and whether tokens must be DPoP- or certificate-bound. A WWW-Authenticate challenge can point at it with the resource_metadata parameter, so a client that gets a 401 can discover where to go without being configured in advance.

www.rfc-editor.org/rfc/rfc9728....The standard

IETF — OAuth working group, Standards TrackGoverning body

2025First published

RFC 9728 (April 2025)Current version

Yes — a defined JSON metadata documen...Machine-readable schema · open

0providers in the catalog

Also known as RFC 9728, Protected Resource Metadata, PRM, oauth-protected-resource.

Providers that carry OAuth 2.0 Protected Resource Metadata 0

No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements OAuth 2.0 Protected Resource Metadata and says so in its APIs.json profile appears here on the next build. Add or correct a listing.

Read from the API Evangelist standards directory, facts verified 2026-08-24. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.