# OAuth Protected Resource metadata (RFC 9728)

Check id `oauth-protected-resource` · Connectability · runs in the free CLI · pre-release, in calibration

**What we look for.** Whether your server publishes protected-resource metadata (RFC 9728) naming its authorization servers.

**Why it matters.** It's the second step of the chain: the host reads it to learn where to send the user to sign in.

**How to pass.** Serve /.well-known/oauth-protected-resource as JSON with resource and authorization_servers.

Run it: `npx backwatch your-site.com --pillar connectability` and find `oauth-protected-resource` in the report.