Skip to main content

Discover authentication

Start by calling the MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP endpoint normally. If the resource requires authorization, it should return a 401 challenge with a pointer to OAuth Protected ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. Metadata.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

1. Fetch protected-resource metadata​

GET https://mcp.example.com/.well-known/oauth-protected-resource

Example response:

{
  "resource": "https://mcp.example.com",
  "authorization_servers": [
    "https://api.aigw.eval.loginid.ai/<RESOURCE_ID>"
  ]
}

Use the advertised authorization-server base URL rather than hard-coding an AIGW Resource ID.

2. Fetch AIGW discovery​

GET https://api.aigw.eval.loginid.ai/<RESOURCE_ID>/.well-known/openid-configuration

The discovery document exposes, among other values:

  • per-resource authorization endpoint;
  • global/core token endpoint;
  • registration endpoint;
  • supported scopes including the resource's own scopes;
  • PKCEPKCEProof Key for Code Exchange: binds an authorization request to the later code exchange so a stolen code is useless. support;
  • supported token-endpoint authentication methods.

A notable detail is that the document's issuer and jwks_uri point to the core AIGW issuer/key set for agent-facing tokens, while the authorization endpoint itself is per-resource.

3. Select requested scopes​

Use discovery to determine supported scopes, then request the minimum needed by the MCP/UCP operation. Resource-specific scopes such as search:read appeared in discovery in the supplied run.

Continue to Register with AIGW.