Alpha. Configuration for withOAuthProtectedResource.
Both options accept a fixed string or a function of the request. Both default to values derived from the request as it arrives through the Supabase Edge Functions proxy, so no configuration is needed there.
The OAuth Protected Resource surface is alpha — the config shape, the contributed context key, and the metadata route may change in a minor release.
The resource identifier to advertise — this endpoint's externally-visible URL, which RFC 9728 §3.3 requires to equal the URL the client called. Defaults to the Edge Functions derivation. Required on any other backend, usually from the request — `(req) => new URL(req.url).origin + '/api/mcp'` — and throws `EnvError` (`MISSING_RESOURCE_SERVER`) if unset there.
The OAuth 2.1 authorization server to advertise, as an issuer identifier. Defaults to the project's Supabase Auth on Edge Functions. Elsewhere it falls back to `SUPABASE_PUBLIC_URL`, then `SUPABASE_URL`, each with `/auth/v1` appended, and throws `EnvError` (`MISSING_AUTHORIZATION_SERVER`) if neither is set. Pass fromSupabaseUrl for a specific project, or any other issuer directly.