Protected Resource Metadata

OAuth Protected ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. Metadata tells an agent which authorization server protects the MCPMCPModel Context Protocol: a standard way for AI agents to call tools and data sources exposed by a server./UCP endpoint.

Resource response

An unauthenticated request should receive a challenge such as:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

Metadata document

{
  "resource": "https://mcp.example.com",
  "authorization_servers": [
    "https://api.aigw.eval.loginid.ai/<RESOURCE_ID>"
  ]
}

The AIGW Token exchange ResourceToken exchange ResourceA Resource for agent access: AIGW authorizes the user and obtains a token from the merchant's own authorization server. Reference page includes Download oauth-protected-resource.json for this purpose.

The agent uses authorization_servers to find AIGW discovery. Keep the metadata public and free of secrets.