OptionalresourceThe resource identifier to advertise — this endpoint's externally-visible URL, which RFC 9728 §3.3 requires to equal the URL the client called.
Defaults to the Edge Functions derivation. Required on any other backend,
usually from the request — (req) => new URL(req.url).origin + '/api/mcp'.
Unset there, every request other than the metadata route's OPTIONS
preflight is answered with a 500 and code MISSING_RESOURCE_SERVER.
OptionalauthorizationThe OAuth 2.1 authorization server to advertise, as an issuer identifier.
Defaults to the project's Supabase Auth on Edge Functions. Elsewhere it
falls back to SUPABASE_PUBLIC_URL, then SUPABASE_URL, each with
/auth/v1 appended; with neither set, the metadata route is answered with
a 500 and code MISSING_AUTHORIZATION_SERVER. Pass
fromSupabaseUrl for a specific project, or any other issuer
directly.
OptionalerrorsHow much of an error to include in a short-circuit response body.
Configuration for withOAuthProtectedResource.
Both options accept a fixed string or a function of the request. Both default to values derived from the request as it arrives through the Supabase Edge Functions proxy, so no configuration is needed there.