Remediation
`/.well-known/oauth-protected-resource` is published per RFC 9728 so agents can discover required scopes and authorization servers programmatically.
discoverability.oauth_protected_resourcediscoverabilityweight 1deterministic
Why it matters
`/.well-known/oauth-protected-resource` is published per RFC 9728 so agents can discover required scopes and authorization servers programmatically.
Underlying specification: https://datatracker.ietf.org/doc/html/rfc9728
How to fix
- See the full check definition in the rubric (linked above) for the canonical reference.
- Read the underlying specification at https://datatracker.ietf.org/doc/html/rfc9728.
Hand it to your AI assistant
Paste this into Claude Code, Cursor, or any assistant with your repository open. It carries the steps, how to verify them, and the shortcuts to avoid. It is generic, though: run a scan to get one written from what your pages actually do.
Run a scan to check your site
Verify on your site
Run a scan against your domain to see whether discoverability.oauth_protected_resource currently passes, warns, or fails. Free, no signup; the score page is permanent and citable.