A protected resource is an API or server, such as a Model Context Protocol (MCP) server, that requires a valid, scoped access token before it will act on a request. Registering a protected resource lets an authorization server know which resource URLs it is allowed to issue tokens for, and it is what makes audience-restricted tokens possible.
Frequently asked questions
Does every API need to register as a protected resource?
Any API that wants tokens scoped and audience-restricted specifically to it should register, otherwise it risks accepting tokens that were actually issued for a different resource.
Why does this matter more for AI agents than for typical apps?
Agents often call many different tools and services, so audience restriction prevents a token issued for one from being replayed against another.
.avif)