AlphaOptional AlpharesourceThe resource identifier to advertise — this endpoint's externally-visible URL, which RFC 9728 §3.3 requires to equal the URL the client called.
Defaults to the Edge Functions derivation. Required on any other backend,
usually from the request — (req) => new URL(req.url).origin + '/api/mcp'.
Unset there, every request other than the metadata route's OPTIONS
preflight is answered with a 500 and code MISSING_RESOURCE_SERVER.
Optional AlphaauthorizationThe OAuth 2.1 authorization server to advertise, as an issuer identifier.
Defaults to the project's Supabase Auth on Edge Functions. Elsewhere it
falls back to SUPABASE_PUBLIC_URL, then SUPABASE_URL, each with
/auth/v1 appended; with neither set, the metadata route is answered with
a 500 and code MISSING_AUTHORIZATION_SERVER. Pass
fromSupabaseUrl for a specific project, or any other issuer
directly.
Optional AlphaerrorsHow much of an error to include in a short-circuit response body.
Alpha. Configuration for withOAuthProtectedResource.
Both options accept a fixed string or a function of the request. Both default to values derived from the request as it arrives through the Supabase Edge Functions proxy, so no configuration is needed there.
The OAuth Protected Resource surface is alpha — the config shape, the contributed context key, and the metadata route may change in a minor release.