OAuth protected-resource metadata for the ChatGPT MCP surface

Returns the RFC 9728 path-scoped protected-resource metadata for the /mcp/chatgpt MCP surface, which is what its WWW-Authenticate challenge names on a 401. resource names /mcp/chatgpt on this origin rather than the origin itself, so a client can check the document answers for the endpoint it called. authorization_servers names the surface too while CHARMING__SERVER__CHATGPT_AUTH_PROXY_ADVERTISED is on, which is what sends this surface’s clients to their own authorization-server document; otherwise it matches the origin-wide document.

curl -X GET "https://charm.ing/.well-known/oauth-protected-resource/mcp/chatgpt"

const response = await fetch("https://charm.ing/.well-known/oauth-protected-resource/mcp/chatgpt", {
  method: "GET"
});

import requests

response = requests.get(
    "https://charm.ing/.well-known/oauth-protected-resource/mcp/chatgpt",
)

{}