<!-- llms.txt: https://workos.com/llms.txt -->

# MCP resource indicator

:::code-group{title="Example MCP resource indicator"}

```json language="curl"
{
  "object": "authkit_oauth_resource",
  "id": "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT",
  "uri": "https://api.example.com",
  "default": false,
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Create an MCP resource indicator

Adds an MCP resource indicator (RFC 8707) to an environment, leaving any others in place.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/user_management/authkit_oauth_resources" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "uri": "https://api.example.com"
    }
BODY
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.user_management.create_authkit_oauth_resource(uri: "https://api.example.com")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.user_management.create_authkit_oauth_resource(uri="https://api.example.com")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.UserManagement().CreateAuthkitOAuthResource(context.Background(), &workos.UserManagementCreateAuthkitOAuthResourceParams{
		URI: "https://api.example.com",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->userManagement()
    ->createAuthkitOAuthResource(uri: "https://api.example.com");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.usermanagement.UserManagementApi.CreateAuthkitOAuthResourceOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateAuthkitOAuthResourceOptions options =
    CreateAuthkitOAuthResourceOptions.builder().uri("https://api.example.com").build();

workos.userManagement.createAuthkitOAuthResource(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.UserManagement.CreateAuthkitOAuthResourceAsync(new UserManagementCreateAuthkitOAuthResourceOptions {
    Uri = "https://api.example.com",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::user_management::CreateAuthkitOAuthResourceParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .user_management()
        .create_authkit_oauth_resource(
            CreateAuthkitOAuthResourceParams {
                uri: "https://api.example.com".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authkit_oauth_resource",
  "id": "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT",
  "uri": "https://api.example.com",
  "default": false,
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Delete an MCP resource indicator

Removes an MCP resource indicator from an environment. Any application consents granted against it are removed too.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request DELETE \
  --url "https://api.workos.com/user_management/authkit_oauth_resources/authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.user_management.delete_authkit_oauth_resource(id: "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.user_management.delete_authkit_oauth_resource(
    id_="authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.UserManagement().DeleteAuthkitOAuthResource(context.Background(), "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->userManagement()
    ->deleteAuthkitOAuthResource(
        id: "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.userManagement.deleteAuthkitOAuthResource(
    "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.UserManagement.DeleteAuthkitOAuthResourceAsync("authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .user_management()
        .delete_authkit_oauth_resource("authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT")
        .await?;

    Ok(())
}
```

:::

## List MCP resource indicators

Lists the MCP resource indicators configured for an environment.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/user_management/authkit_oauth_resources" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.user_management.list_authkit_oauth_resources
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.user_management.list_authkit_oauth_resources()
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.UserManagement().ListAuthkitOAuthResources(context.Background())
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->userManagement()->listAuthkitOAuthResources();
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.userManagement.listAuthkitOAuthResources();
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.UserManagement.ListAuthkitOAuthResourcesAsync();
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .user_management()
        .list_authkit_oauth_resources()
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "authkit_oauth_resource",
      "id": "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT",
      "uri": "https://api.example.com",
      "default": false,
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "list_metadata": {
    "before": "authkit_oauth_resource_01HXYZ123456789ABCDEFGHIJ",
    "after": "authkit_oauth_resource_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

### authkit_oauth_resource

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "authkit_oauth_resource" | Yes | The object type. |
| `id` | string | Yes | The ID of the MCP resource indicator. |
| `uri` | string | Yes | The resource URI. |
| `default` | boolean | Yes | Whether this is the default MCP resource indicator for the environment. |
| `created_at` | string | Yes | The timestamp when the MCP resource indicator was created. |
| `updated_at` | string | Yes | The timestamp when the MCP resource indicator was last updated. |

### POST /user_management/authkit_oauth_resources

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `uri` | string | Yes | The resource URI. May be a wildcard pattern with a single `*` in the leftmost hostname label, where enabled for the environment. |
| `default` | boolean | No | Whether the resource being created becomes the environment default, clearing any previous default. Applies at creation only — this API has no update endpoint yet, so changing the default on an existing resource is done from the dashboard. A wildcard pattern cannot be the default. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authkit_oauth_resource` | object | The object type. |

### DELETE /user_management/authkit_oauth_resources/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The ID of the MCP resource indicator to delete. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### GET /user_management/authkit_oauth_resources

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `before` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. |
| `after` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. |
| `limit` | integer | No | Upper limit on the number of objects to return, between `1` and `100`. Defaults to `10`. |
| `order` | "normal" \| "desc" \| "asc" | No | Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. |