MCP server · Discovery

resource_metadata in the 401 challenge

An unauthenticated request receives a 401 whose WWW-Authenticate header carries a resource_metadata parameter pointing at the PRM document.

mcp.prm.www-authenticate

In revision 2026-07-28

Level
MUST One of two discovery mechanisms the server must offer.
Defined in
Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28
Party
MCP server
Observable
passive Observable by reading published metadata, without any request to the server.

Level by revision

RevisionLevelSection
2026-07-28currentMUST One of two discovery mechanisms the server must offer.Authorization Server Discovery › Protected Resource Metadata Discovery Requirements
2025-11-25MUST One of two discovery mechanisms the server must offer.Authorization Server Discovery › Protected Resource Metadata Discovery Requirements

Adoption

Across the listed servers

Supported 31

Unsupported 4

Unknown 1

Not applicable 3