Protected Resource Metadata

A well-known document in which a resource server says which authorization servers it trusts and how to call it.

Where it stands: Published RFC
Official text: RFC 9728
Documented support: 2
Activity: 0

No explainer written for this spec yet. The summary, relations and documented support below are maintained.

A well-known document in which a resource server says which authorization servers it trusts and how to call it.

How it relates to other specs

Relations diagram

flowchart LR
  s_prm["Protected Resource Metadata"]
  s_as_metadata["Authorization Server Metadata"]
  style s_prm stroke-width:3px
  s_prm -->|Works with| s_as_metadata

Documented support

Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.

Products, identity providers and services

Model Context Protocol (Specification): MCP authorization spec (2025-11-25) uses RFC 9728 Protected Resource Metadata to discover the authorization server source (verified 2026-11-11)
Kong Gateway (OpenID Connect plugin) (Product): The OIDC plugin advertises an upstream API as an RFC 9728 protected resource source (verified 2026-11-11)

Activity

Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.

Nothing collected about this spec yet.