Configuration of OAuth 2.0 Resource Metadata (oauth-protected-resource.json)

The FirstSpirit server can provide metadata according to the OAuth 2.0 Protected Resource Metadata standard (RFC 9728). Through this metadata, OAuth clients can address FirstSpirit as a resource server and identify the responsible authorization servers.

Storage location and delivery

The file is expected in the configuration directory conf of the FirstSpirit server:

<FSROOT>/conf/oauth-protected-resource.json

If the file exists, it will be delivered without authentication at the following URL:

<FSURL>/.well-known/oauth-protected-resource

The FirstSpirit server delivers the content of the file unchanged. No processing, addition, or validation of the content takes place; the structure and validity of the metadata are the responsibility of the administrator (specifications see RFC 9728).

Creating, modifying, and deleting the file takes effect immediately – a restart of the FirstSpirit server is not required. The server checks the file's modification time with each request. If the file is not present, no content will be delivered at the specified URL.

Structure of the file

The file contains a JSON object with the fields defined in RFC 9728.

Example:

{
   "resource": "https://mcp.example.com",
   "authorization_servers": [
     "https://auth.example.com"
   ],
   "scopes_supported": [
     "mcp:read",
     "mcp:write"
   ],
   "bearer_methods_supported": [
     "header"
   ],
   "resource_name": "FirstSpirit REST MCP Server",
   "resource_documentation": "https://docs.example.com/mcp",
   "jwks_uri": "https://mcp.example.com/.well-known/jwks.json"
 }

The individual fields are configured exclusively through this file. A complete description of the permissible fields and their meanings can be found in RFC 9728.