Function withOAuthProtectedResource

withOAuthProtectedResource(
handler: (req: Request, platformArg?: unknown) => Promise<Response>,
): (req: Request, platformArg?: unknown) => Promise<Response>
Wraps a request handler with OAuth 2.1 Protected Resource behavior (RFC 9728) for Supabase Edge Functions.
- Serves OAuth Protected Resource Metadata at GET /{fn}/oauth-protected-resource (with permissive CORS, including the OPTIONS preflight, so browser-based clients can read it)
- Enriches a 401 from the inner handler with WWW-Authenticate: Bearer resource_metadata="...", unless the handler already set a WWW-Authenticate header (its value wins)
- Returns 404 for any other path (Edge Functions are single-endpoint - the inner handler owns /{fn} only)
The returned handler's optional second parameter is the host's platform argument (a Workers env, a Deno ServeHandlerInfo) and is forwarded to the inner handler unchanged — required for withSupabase to capture it.
Parameters
- handler: (req: Request, platformArg?: unknown) => Promise<Response>
Returns (req: Request, platformArg?: unknown) => Promise<Response>
Example
```
import { withOAuthProtectedResource, withSupabase } from '@supabase/server'

Deno.serve(
  withOAuthProtectedResource(
    withSupabase({ auth: 'user' }, async (_req, { supabase }) => {
      const { data, error } = await supabase.from('items').select('*')
      if (error) throw error
      return Response.json(data)
    }),
  ),
)
```
- Defined in oauth-protected-resource/with-oauth-protected-resource.ts:35

Function withOAuthProtectedResource

Parameters

Returns (req: Request, platformArg?: unknown) => Promise<Response>

Example

Settings