@supabase/server - v1.7.0
    Preparing search index...

    Interface OAuthProtectedResourceConfigAlpha

    Alpha. Configuration for withOAuthProtectedResource.

    Both options accept a fixed string or a function of the request. Both default to values derived from the request as it arrives through the Supabase Edge Functions proxy, so no configuration is needed there.

    The OAuth Protected Resource surface is alpha — the config shape, the contributed context key, and the metadata route may change in a minor release.

    interface OAuthProtectedResourceConfig {
        resourceServer?: UrlOption;
        authorizationServer?: UrlOption;
        errors?: ErrorResponseConfig;
    }

    Hierarchy (View Summary)

    Index

    Properties

    resourceServer?: UrlOption

    The resource identifier to advertise — this endpoint's externally-visible URL, which RFC 9728 §3.3 requires to equal the URL the client called.

    Defaults to the Edge Functions derivation. Required on any other backend, usually from the request — (req) => new URL(req.url).origin + '/api/mcp'. Unset there, every request other than the metadata route's OPTIONS preflight is answered with a 500 and code MISSING_RESOURCE_SERVER.

    authorizationServer?: UrlOption

    The OAuth 2.1 authorization server to advertise, as an issuer identifier.

    Defaults to the project's Supabase Auth on Edge Functions. Elsewhere it falls back to SUPABASE_PUBLIC_URL, then SUPABASE_URL, each with /auth/v1 appended; with neither set, the metadata route is answered with a 500 and code MISSING_AUTHORIZATION_SERVER. Pass fromSupabaseUrl for a specific project, or any other issuer directly.

    How much of an error to include in a short-circuit response body.