# `ExMCP.Authorization.ProtectedResourceMetadata`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/authorization/protected_resource_metadata.ex#L1)

OAuth 2.0 Protected Resource Metadata Discovery (RFC 9728 - Draft).

This module implements the discovery mechanism for protected resources to
advertise their authorization server relationships. This allows MCP servers
to indicate which authorization servers protect their resources.

## Example

    # Discover authorization servers for a protected resource
    {:ok, metadata} = ProtectedResourceMetadata.discover("https://api.example.com/mcp")

    # Use discovered authorization server
    [auth_server | _] = metadata.authorization_servers
    {:ok, auth_metadata} = Authorization.discover_server_metadata(auth_server.issuer)

# `authorization_server`

```elixir
@type authorization_server() :: %{
  issuer: String.t(),
  metadata_endpoint: String.t() | nil,
  scopes_supported: [String.t()] | nil,
  audience: String.t() | [String.t()] | nil
}
```

# `metadata`

```elixir
@type metadata() :: %{authorization_servers: [authorization_server()]}
```

# `www_authenticate_info`

```elixir
@type www_authenticate_info() :: %{
  realm: String.t() | nil,
  as_uri: String.t() | nil,
  resource_uri: String.t() | nil,
  error: String.t() | nil,
  error_description: String.t() | nil
}
```

# `discover`

```elixir
@spec discover(
  String.t(),
  keyword()
) :: {:ok, metadata()} | {:error, term()}
```

Discovers protected resource metadata from the resource URL.

Makes a request to /.well-known/oauth-protected-resource to discover
which authorization servers protect this resource. The request uses the
shared HTTPS-only, public-address, pinned metadata fetch boundary. Test and
local-development callers may explicitly enable the loopback-only HTTP
exception supported by `ExMCP.Authorization.MetadataFetcher`.

# `parse_www_authenticate`

```elixir
@spec parse_www_authenticate(String.t()) ::
  {:ok, www_authenticate_info()} | {:error, term()}
```

Parses WWW-Authenticate header for authorization information.

Extracts Bearer authentication parameters including realm, as_uri,
resource_uri, and error information.

---

*Consult [api-reference.md](api-reference.md) for complete listing*