github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4394] [MERGED] feat(mcp): add protected-resource metadata endpoint #5356

New Issue
Closed
opened 2026-03-13 12:20:04 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:20:04 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4394
Author: @frectonz
Created: 9/3/2025
Status: ✅ Merged
Merged: 9/4/2025
Merged by: @Bekacru

Base: canary ← Head: feat/mcp-protected-resource-metadata

📝 Commits (5)

  • be414b5 feat(mcp): add protected-resource metadata endpoint
  • ca6072b fix(mcp): remove runtime check for baseURL
  • 13bb7c7 docs(mcp): mention oAuthProtectedResourceMetadata
  • 3c80a2f Update docs/content/docs/plugins/mcp.mdx
  • c7d899e Merge branch 'canary' into feat/mcp-protected-resource-metadata

📊 Changes

2 files changed (+70 additions, -1 deletions)

View changed files

📝 docs/content/docs/plugins/mcp.mdx (+11 -0)
📝 packages/better-auth/src/plugins/mcp/index.ts (+59 -1)

📄 Description

Done

  • Implemented protected resource metadata endpoint.
  • Updated docs
    image

Summary by cubic

Add OAuth protected resource metadata for MCP. Exposes a new discovery endpoint and updates the WWW-Authenticate challenge to point to it for better client interop.

  • New Features

    • New /.well-known/oauth-protected-resource endpoint returning resource metadata (jwks_uri, scopes_supported, bearer_methods_supported, resource_signing_alg_values_supported).
    • Helper to serve protected resource metadata with CORS headers.

  • Migration

    • The WWW-Authenticate header now links to /.well-known/oauth-protected-resource (was /.well-known/oauth-authorization-server). Update clients that follow resource_metadata to use the new endpoint.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4394 **Author:** [@frectonz](https://github.com/frectonz) **Created:** 9/3/2025 **Status:** ✅ Merged **Merged:** 9/4/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `feat/mcp-protected-resource-metadata` --- ### 📝 Commits (5) - [`be414b5`](https://github.com/better-auth/better-auth/commit/be414b5933593132f38e47b6de4e85ebe7b9c788) feat(mcp): add protected-resource metadata endpoint - [`ca6072b`](https://github.com/better-auth/better-auth/commit/ca6072bbf513869eba17c3381a33331f7ede8b12) fix(mcp): remove runtime check for baseURL - [`13bb7c7`](https://github.com/better-auth/better-auth/commit/13bb7c717a0e9260063faf3ccf663d54d98eb35c) docs(mcp): mention `oAuthProtectedResourceMetadata` - [`3c80a2f`](https://github.com/better-auth/better-auth/commit/3c80a2f04d595d2b9ffdfbfcca514060faf6b89b) Update docs/content/docs/plugins/mcp.mdx - [`c7d899e`](https://github.com/better-auth/better-auth/commit/c7d899e6a83a4740cdd88f4725beed4a32845460) Merge branch 'canary' into feat/mcp-protected-resource-metadata ### 📊 Changes **2 files changed** (+70 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/mcp.mdx` (+11 -0) 📝 `packages/better-auth/src/plugins/mcp/index.ts` (+59 -1) </details> ### 📄 Description Done - Implemented protected resource metadata endpoint. - Updated docs <img width="918" height="275" alt="image" src="https://github.com/user-attachments/assets/17b60740-9c6f-4397-9ca6-cc01af8aa5fd" /> <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Add OAuth protected resource metadata for MCP. Exposes a new discovery endpoint and updates the WWW-Authenticate challenge to point to it for better client interop. - **New Features** - New /.well-known/oauth-protected-resource endpoint returning resource metadata (jwks_uri, scopes_supported, bearer_methods_supported, resource_signing_alg_values_supported). - Helper to serve protected resource metadata with CORS headers. - **Migration** - The WWW-Authenticate header now links to /.well-known/oauth-protected-resource (was /.well-known/oauth-authorization-server). Update clients that follow resource_metadata to use the new endpoint. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:20:04 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5356
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?