Struct ProtectedResourceMetadata 

pub struct ProtectedResourceMetadata {
    pub resource: String,
    pub authorization_servers: Vec<String>,
    pub scopes_supported: Vec<String>,
    pub bearer_methods_supported: Vec<String>,
    pub resource_documentation: Option<String>,
}

Protected Resource Metadata per RFC 9728 Section 3.

This metadata document tells OAuth clients which authorization server(s) to use and what scopes are available. It is served at the RFC 9728 well-known location for the resource URL. For a resource with a path, such as https://example.com/mcp, that location is https://example.com/.well-known/oauth-protected-resource/mcp.

Example

use tower_mcp::oauth::ProtectedResourceMetadata;

let metadata = ProtectedResourceMetadata::new("https://mcp.example.com")
    .authorization_server("https://auth.example.com")
    .scope("mcp:read")
    .scope("mcp:write")
    .resource_documentation("https://docs.example.com/mcp");

Fields

resource: String

The resource server’s identifier URL.

This MUST be the URL the client uses to access the resource.

authorization_servers: Vec<String>

Authorization server issuer URLs that can issue tokens for this resource.

scopes_supported: Vec<String>

OAuth scopes supported by this resource server.

bearer_methods_supported: Vec<String>

Methods supported for sending bearer tokens.

Defaults to ["header"] per RFC 6750.

resource_documentation: Option<String>

URL of documentation for this resource.

Implementations

impl ProtectedResourceMetadata

pub fn new(resource: impl Into<String>) -> Self

Create new metadata with the resource server’s identifier URL.

pub fn authorization_server(self, issuer_url: impl Into<String>) -> Self

Add an authorization server issuer URL.

pub fn scope(self, scope: impl Into<String>) -> Self

Add a supported OAuth scope.

pub fn resource_documentation(self, url: impl Into<String>) -> Self

Set the resource documentation URL.

pub fn bearer_methods(self, methods: Vec<String>) -> Self

Set the bearer methods supported.

pub fn well_known_path() -> &'static str

Returns the well-known path for this metadata endpoint.

This is the prefix used for root resources. For resources with a path, use Self::well_known_path_for_resource.

pub fn well_known_path_for_resource( resource: &str, ) -> Result<String, ProtectedResourceMetadataError>

Return the path-aware RFC 9728 well-known path for a resource URL.

A resource at https://example.com/mcp maps to /.well-known/oauth-protected-resource/mcp. Query and fragment components are not copied to the metadata endpoint.

pub fn well_known_url(&self) -> Result<String, ProtectedResourceMetadataError>

Return the absolute RFC 9728 metadata URL for this resource.

pub fn validate(&self) -> Result<(), ProtectedResourceMetadataError>

Validate metadata required by an MCP OAuth resource server.

This checks that the resource is an absolute HTTP(S) URL without a fragment and that at least one valid authorization-server URL is advertised.

Trait Implementations

impl Clone for ProtectedResourceMetadata

fn clone(&self) -> ProtectedResourceMetadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProtectedResourceMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProtectedResourceMetadata

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ProtectedResourceMetadata

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.