> ## Documentation Index
> Fetch the complete documentation index at: https://nevermined.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Protected Resource Metadata (RFC 9728)

> Names this issuer in authorization_servers and points at the human/agent documentation (auth.md). The WWW-Authenticate challenge on a genuine 401 references this document.



## OpenAPI

````yaml /api-reference/oauth-openapi.json get /.well-known/oauth-protected-resource
openapi: 3.0.0
info:
  title: Nevermined Authentication API
  description: >-
    The OAuth 2.1 + RFC 8628 device-flow ceremony and standards-based discovery
    endpoints an agent or connector uses to obtain and manage a Nevermined
    credential. These endpoints are root-mounted (not under /api/v1).
  version: 1.0.0
  contact: {}
servers:
  - url: https://api.sandbox.nevermined.app
    description: Sandbox
  - url: https://api.live.nevermined.app
    description: Live
security: []
tags:
  - name: Authentication - Ceremony
    x-group: Ceremony
    description: Authorization Code (PKCE) and RFC 8628 device grant.
  - name: Authentication - Connections
    x-group: Connections
    description: AgentBindings — the consent receipts a user manages.
  - name: Authentication - Discovery
    x-group: Discovery
    description: RFC 8414 / 9728 / JWKS metadata.
paths:
  /.well-known/oauth-protected-resource:
    get:
      tags:
        - Authentication - Discovery
      summary: Protected Resource Metadata (RFC 9728)
      description: >-
        Names this issuer in authorization_servers and points at the human/agent
        documentation (auth.md). The WWW-Authenticate challenge on a genuine 401
        references this document.
      responses:
        '200':
          description: RFC 9728 metadata
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                example:
                  resource: https://api.sandbox.nevermined.app
                  authorization_servers:
                    - https://api.sandbox.nevermined.app
                  bearer_methods_supported:
                    - header
                  resource_documentation: https://nevermined.app/auth.md

````

## Related topics

- [Authentication & Identity](/docs/integrate/authentication/overview.md)
- [Authentication for AI Agents](/docs/integrate/authentication/for-agents.md)
- [Device Flow (RFC 8628)](/docs/integrate/authentication/device-flow.md)
- [MCP](/docs/integrations/mcp.md)
- [Authorization Server Metadata (RFC 8414)](/docs/api-reference/authentication--discovery/authorization-server-metadata-rfc-8414.md)