OAuth protected resource metadata | Runtype Documentation

RFC 9728 Protected Resource Metadata for a surface-specific MCP endpoint. Public (no auth).

AuthorizationBearer

API key or Clerk session token

productIdstringRequired

surfaceIdstringRequired

RFC 9728 protected resource metadata

authorization_serverslist of strings

bearer_methods_supportedlist of strings

resourcestring

500

Internal Server Error

1	{
2	"authorization_servers": [
3	"https://auth.runtype.com/oauth2"
4	],
5	"bearer_methods_supported": [
6	"authorization_header",
7	"form_encoded_body"
8	],
9	"resource": "https://api.runtype.com/v1/products/abc123/surfaces/web/mcp"
10	}

1	{
2	"authorization_servers": [
3	"https://auth.runtype.com/oauth2"
4	],
5	"bearer_methods_supported": [
6	"authorization_header",
7	"form_encoded_body"
8	],
9	"resource": "https://api.runtype.com/v1/products/abc123/surfaces/web/mcp"
10	}

$	curl https://api.runtype.com/v1/products/productId/surfaces/surfaceId/mcp/.well-known/oauth-protected-resource \
>	-H "Authorization: <apiKey>" \
>	-H "Content-Type: application/json"