---
title: "Explain how to get API access · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses/oauth-protected-resource
updated: 2026-10-20
licence: "All rights reserved"
---

# Explain how to get API access

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)
- Rule: If an API needs OAuth, describe how to get access at `/.well-known/oauth-protected-resource`.
- How: Serve JSON in the RFC 9728 format, naming the resource, the authorisation servers and scopes. The `resource` must equal the API's URL. When a request lacks a valid token, answer 401 with a `WWW-Authenticate` header that points to this file. MCP clients use that header to start sign-in.
- Check: An unauthenticated request to the API returns 401 with `resource_metadata` in `WWW-Authenticate`. That URL returns the JSON, and its `resource` matches the API.

Example:

```json
{
  "resource": "https://api.example.com",
  "authorization_servers": ["https://example.com"],
  "scopes_supported": ["read", "write"]
}
```

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://api.example.com/.well-known/oauth-protected-resource"
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/oauth-protected-resource`.

- Previous: [Publish OAuth server settings](https://agentwranglers.se/playbook/website/standard-addresses/oauth-authorization-server)
- Next: [Say you honour privacy signals](https://agentwranglers.se/playbook/website/standard-addresses/gpc-json)
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)