OAuthResourceMetadataResponse

RFC 9728 OAuth Protected Resource Metadata (client-side response).

Properties

authorizationServers: string[];

Authorization-server issuer URLs; the first is used for OIDC discovery (authorization_servers).

optional bearerMethodsSupported?: string[];

Advertised bearer methods, e.g. ["header"] (bearer_methods_supported).

optional clientId?: string;

OAuth client_id advertised by the server.

optional clientSecret?: string;

OAuth client_secret advertised by the server.

optional deviceCodeClientId?: string;

OAuth client_id for device code flow.

optional deviceCodeClientSecret?: string;

OAuth client_secret for device code flow.

resource: string;

The protected resource’s canonical URL (resource).

optional resourceDocumentation?: string;

Documentation URL for the resource (resource_documentation).

optional resourceName?: string;

Human-readable resource name (resource_name).

optional resourcePolicyUri?: string;

Policy URL for the resource (resource_policy_uri).

optional resourceSigningAlgValuesSupported?: string[];

JWS algorithms the resource accepts (resource_signing_alg_values_supported).

optional resourceTosUri?: string;

Terms-of-service URL for the resource (resource_tos_uri).

optional scopesSupported?: string[];

Scopes the resource advertises (scopes_supported).

optional useIdTokenAsBearer?: boolean;

When true, use the OIDC id_token as the Bearer token instead of access_token.