No OAuth Protected Resource metadata
OAuth Protected Resource metadata, defined by RFC 9728, is a file that tells AI agents how to obtain the access tokens (temporary digital keys) needed to call your authenticated, logged-in-only endpoints. This check found your site publishes none of this metadata.
Why this matters
This is only relevant if you want AI agents to act on behalf of a logged-in user against your protected API, for example managing an account or placing an order. If you don't expose any authenticated API to agents, there's genuinely no loss here; if you do, agents currently have no standard way to authenticate against it.
How to fix it
Your developer needs about 1 hour, and only if this applies to your business. If you have a protected API you want agents to use, publish /.well-known/oauth-protected-resource naming your authorization server (the system that issues access tokens) and the scopes (permission levels) it supports.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit