---
title: OAuth protected resource metadata for the MCP endpoint
url: https://developers.wpengine.com/docs/ai/api/reference/operations/mcpprotectedresourcemetadata/
image: https://developers.wpengine.com/og/docs/ai/api/reference/operations/mcpprotectedresourcemetadata.png
---

# OAuth protected resource metadata for the MCP endpoint

GET

/.well-known/oauth-protected-resource/v1/mcp

Select code sample

```php
<?php


$client = new \GuzzleHttp\Client();


$response = $client->request('GET', 'https://api.ai.wpengine.com/.well-known/oauth-protected-resource/v1/mcp');


echo $response->getBody();
```

- Current environment

OAuth 2.0 Protected Resource Metadata (RFC 9728) for `/v1/mcp`, naming the authorization server an MCP client obtains an access token from. This is the discovery entry point for interactive OAuth sign-in: an MCP client that calls `/v1/mcp` without a credential receives `401` with a `WWW-Authenticate: Bearer resource_metadata="..."` challenge pointing at this document. The `resource` value is the canonical URI of the MCP endpoint, and is the value a client must send as the RFC 8707 `resource` parameter on its authorization and token requests. A token is accepted at `/v1/mcp` only when its `aud` claim is that same URI. No credential is required, and the response is readable from any origin. `scopes_supported` lists every scope a client may request. A client asks for all of them when it first signs in, and the user can leave out any of them, such as the scopes for tools that act on a live environment, on the consent screen.

## Authorizations

- **None**

## Responses

### 200

The protected resource metadata document.

Media typeapplication/json

OAuth 2.0 Protected Resource Metadata (RFC 9728 §2) for the MCP endpoint. Fields not listed here are omitted; a client must ignore members it does not understand.

object

**resource**

required

The canonical URI of the MCP endpoint. A client must discard this document if the value is not identical to the URL it requested the MCP endpoint at (RFC 9728 §3.3).

string

**authorization_servers**

required

Issuer identifiers of the authorization servers that issue access tokens for this resource. A client discovers each one’s endpoints from its own metadata document (RFC 8414).

Array\<string>

**bearer_methods_supported**

required

How an access token may be presented. Only the Authorization request header is supported.

Array\<string>

Allowed values: header

**scopes_supported**

Every scope a client may request. A client requests all of them when it first signs in, and the consent screen lists each one, so the user can leave out a scope such as `urn:wpengine:agent-sandbox:rw` for tools that act on a live environment. A token without a scope a tool needs gets a `403` `insufficient_scope` challenge naming it.

Array\<string>

**resource_name**

Human-readable name of the resource, for a client to show while the user signs in.

string

**resource_documentation**

URL of developer documentation for the MCP endpoint.

string format: uri

#### Example

```json
{
  "resource": "https://api.wpengineapi.com/v1/mcp",
  "bearer_methods_supported": [
    "header"
  ],
  "scopes_supported": [
    "urn:wpengine:ai:wordpress:rw",
    "urn:wpengine:hosting:tools:rw",
    "urn:wpengine:agent-sandbox:ro",
    "urn:wpengine:agent-sandbox:rw",
    "urn:wpengine:accounts:rw",
    "urn:wpengine:installs:rw"
  ],
  "resource_name": "WP Engine",
  "resource_documentation": "https://developers.wpengine.com/docs/ai/api/mcp/"
}
```

### 404

This deployment does not accept interactive OAuth sign-in at the MCP endpoint. API key and Okta authentication are unaffected.

### 405

The document is read-only; use GET or HEAD.

Media typetext/plain

string

## Was this helpful?

Thanks for the feedback!

```json
{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://developers.wpengine.com/#website","name":"WP Engine Product Documentation","url":"https://developers.wpengine.com/","description":"Resources for developing, deploying, and scaling on WP Engine.","inLanguage":"en-US","keywords":["API documentation","product documentation","headless WordPress","managed WordPress hosting"],"publisher":{"@id":"https://wpengine.com/#organization"}}]}
```