Explain how to get API access

If an API needs OAuth, describe how to get access at /.well-known/oauth-protected-resource.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Serve JSON in the RFC 9728 format, naming the authorisation servers and scopes.

Example

{
  "resource": "https://api.example.com",
  "authorization_servers": ["https://example.com"],
  "scopes_supported": ["read", "write"]
}

How to check

Clients find how to get a token.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/oauth-protected-resource.