Where an Agent registers

View .md OpenAPI spec Open in Claude Open in ChatGPT

GET

/.well-known/oauth-protected-resource

const url = 'https://app.caprid.com/.well-known/oauth-protected-resource';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://app.caprid.com/.well-known/oauth-protected-resource

This server’s OAuth protected resource metadata (RFC 9728). It names the WorkOS AuthKit domain where an Agent registers, so an agent or OAuth client that finds this server can get an Agent token without being told where. A 401 from any other route points here too, in its WWW-Authenticate header.

resource is this server’s public origin, the same whichever hostname you fetched this from. This server accepts a token issued for its WorkOS client, which is what an Agent following /auth.md gets, or for exactly that resource (RFC 8707). AuthKit doesn’t issue the second kind: it answers invalid_target to a token request that names a resource, whatever the URL, so leave it out.

Responses

200

The metadata.

application/json

object

resource

required

This server’s public origin, the one resource its Agent tokens may name.

string format: uri

authorization_servers

required

The WorkOS AuthKit domain an Agent registers with.

Array<string>

Example

{
  "resource": "https://app.caprid.com",
  "authorization_servers": [
    "https://auth.caprid.com"
  ]
}

404

This server isn’t set up for Agents.

application/json

object

error

required

string

Example

{
  "error": "the requested grants exceed the key's scope"
}