# RFC 9728: OAuth 2.0 Protected Resource Metadata

> IETF Proposed Standard defining a metadata document a protected resource publishes (at /.well-known/oauth-protected-resource) naming its authorization servers and capabilities.

- id: `rfc-9728`
- category: Protocols (`protocols`)
- url: https://www.rfc-editor.org/rfc/rfc9728.html
- docs: https://datatracker.ietf.org/doc/rfc9728/
- status: active
- tags: auth, oauth, ietf, rfc, mcp
- related: MCP Authorization (OAuth 2.1 for MCP) (https://indexagentica.com/entries/mcp-authorization/); RFC 8707: Resource Indicators for OAuth 2.0 (https://indexagentica.com/entries/rfc-8707/)
- sources: https://datatracker.ietf.org/doc/rfc9728/ , https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
- added: 2026-10-16
- updated: 2026-10-16
- last verified: 2026-10-16
- featured in: Add OAuth authorization to your own MCP server (https://indexagentica.com/guides/add-oauth-to-your-mcp-server/)
- maintainer: IETF OAuth WG
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/rfc-9728/
- json: https://indexagentica.com/api/entries/rfc-9728.json

The MCP authorization spec requires MCP servers to implement RFC 9728 so clients can discover the authorization server; e.g. https://mcp.squareup.com/.well-known/oauth-protected-resource.