Server: OAuthProtectedResourceConfig

Configuration for withOAuthProtectedResource.

Both options accept a fixed string or a function of the request. Both default to values derived from the request as it arrives through the Supabase Edge Functions proxy, so no configuration is needed there.

Parameters

• resourceServer

  (Optional)

  The resource identifier to advertise — this endpoint's externally-visible URL, which RFC 9728 §3.3 requires to equal the URL the client called. Defaults to the Edge Functions derivation. Required on any other backend, usually from the request — `(req) => new URL(req.url).origin + '/api/mcp'`. Unset there, every request other than the metadata route's `OPTIONS` preflight is answered with a `500` and code `MISSING_RESOURCE_SERVER`.

• authorizationServer

  (Optional)

  The OAuth 2.1 authorization server to advertise, as an issuer identifier. Defaults to the project's Supabase Auth on Edge Functions. Elsewhere it falls back to `SUPABASE_PUBLIC_URL`, then `SUPABASE_URL`, each with `/auth/v1` appended; with neither set, the metadata route is answered with a `500` and code `MISSING_AUTHORIZATION_SERVER`. Pass fromSupabaseUrl for a specific project, or any other issuer directly.

• errors

  (Optional)

  How much of an error to include in a short-circuit response body.