{
  "resource": "https://precastuae.ae",
  "authorization_servers": [
    "https://precastuae-pages.cloudflareaccess.com"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "profile",
    "groups"
  ],
  "bearer_methods_supported": [
    "header",
    "cookie"
  ],
  "resource_signing_alg_values_supported": [
    "RS256"
  ],
  "resource_documentation": "https://precastuae.ae/.well-known/api-catalog",
  "resource_policy_uri": "https://precastuae.ae/privacy/",
  "comment": "Cloudflare Access (issuer above) gates internal admin tooling at /tools/*. Public surface (homepage, products, blog, /submit lead-capture) is open. The RFC 9728 'resource' field uses the apex URL because Access policies are scoped per route in the Cloudflare dashboard, not declared in this metadata."
}