No OAuth Protected Resource metadata

OAuth Protected Resource metadata, defined by RFC 9728, is a file that tells AI agents how to obtain the access tokens (temporary digital keys) needed to call your authenticated, logged-in-only endpoints. This check found your site publishes none of this metadata. This is only relevant if you want AI agents to act on behalf of a logged-in user against your protected API, for example managing an account or placing an order. If you don't expose any authenticated API to agents, there's genuinely no loss here; if you do, agents currently have no standard way to authenticate against it. Your developer needs about 1 hour, and only if this applies to your business. If you have a protected API you want agents to use, publish /.well-known/oauth-protected-resource naming your authorization server (the system that issues access tokens) and the scopes (permission levels) it supports.