Alpha. 401 response with a WWW-Authenticate: Bearer resource_metadata="..." header (RFC 9728). The metadata URL defaults to the Edge Functions derivation and throws off platform; pass resourceMetadataUrl to override for custom setups.
The OAuth Protected Resource surface is alpha — the config shape, the contributed context key, and the metadata route may change in a minor release.