# RFC 8707 Resource Indicators

`resource` ([Config.Resource](../settings.go)) is an alternative to `audience` for IdPs that
implement [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707). See
[docs/CONFIGURATION.md](CONFIGURATION.md#audience-validation) for the config reference; this
document covers exactly what request is made and which providers support it.

## What the plugin sends

- One `resource` parameter on the authorization request (`buildAuthURL`), added before
  `extraAuthParams` so an operator-configured `resource` key there cannot override or
  duplicate it.
- The same `resource` parameter on both the `authorization_code` and `refresh_token` grants
  (`exchangeTokens`), per RFC 8707 §2.2 — so a refreshed token keeps the same audience binding
  as the original grant.

Only a single resource is supported, not a list. RFC 8707 allows a server to accept multiple
`resource` values and scope the issued token to a subset of them, but no provider found to
support the parameter at all handles that usefully: one provider tested rejects a request
naming more than one resource with HTTP 400 `invalid_target`; node-oidc-provider accepts
multiple resources but issues an opaque access token bound to none of them. A single value
avoids both failure modes.

## Relationship to `audience`

`resource` and `audience` both feed the same access-token audience check —
`strictAudienceValidation` applies identically to either — but they produce different requests
on the wire:

- `audience`, when explicitly configured, is sent as a non-standard `audience` request
  parameter (see [docs/AUTH0\_AUDIENCE\_GUIDE.md](AUTH0_AUDIENCE_GUIDE.md)).
- `resource` is sent as the RFC 8707 `resource` parameter instead.
- If `resource` is set and `audience` is not, the expected-audience check defaults to the
  resource value, but this is validation-only: it does not cause an `audience` parameter to be
  sent. Setting both is allowed — e.g. as a hedge against a provider that ignores `resource` —
  in which case both parameters are sent.

## Provider support

Verified 2026-09-02 (Zitadel reverified separately against a live instance). RFC 8707 requires
a server that does not support `resource` to *ignore* it, but not every implementation does —
verify against your specific provider and version before relying on it.

| Provider | Support | Notes |
|---|---|---|
| node-oidc-provider | Supported | Via its `resourceIndicators` feature. |
| Zitadel | Ignored, not rejected | `oidc.AuthRequest` has no `resource` field; confirmed against a live instance — `/oauth/v2/authorize` returns the same `302` with or without `resource`, including a spec-invalid value. |
| Authentik | Rejected | Returns `invalid_target` ("Resource indicators are not supported"). |
| Keycloak | Not supported (through 26.6) | Its own guidance is an audience mapper plus `scope` instead ([keycloak/keycloak#41526](https://github.com/keycloak/keycloak/issues/41526)). |
| Ory Hydra / Fosite | Not implemented | Uses its own non-standard `audience` request parameter instead. |
| Azure AD / Entra ID v2.0 (MSAL) | Reported to reject | When combined with v2-style `scope`, rather than ignoring it ([writeup](https://www.groff.dev/blog/azure-entra-id-mcp-server-authentication-incompatibilities)). Do not enable against an Entra ID v2 tenant without confirming. The v1.0 endpoint has a separate, pre-RFC `resource` parameter with similar but not identical semantics. |
| Auth0 | Not verified | Documents a Resource Parameter Compatibility Profile mapping `resource` → `audience` ([Auth0 docs](https://auth0.com/ai/docs/mcp/guides/resource-param-compatibility-profile)). |
| AWS Cognito | Not verified | Announced Oct 2025 for user-pool authorization-code/implicit grants ([announcement](https://aws.amazon.com/about-aws/whats-new/2025/10/amazon-cognito-resource-indicators-protection-oauth-2-0-resources)). |
| Okta, Google, GitLab | Unverified | No confirming documentation found either way. |