diff --git a/internal/start/start.go b/internal/start/start.go
index cf4bc68fd..f48af7783 100644
--- a/internal/start/start.go
+++ b/internal/start/start.go
@@ -489,7 +489,7 @@ EOF
 					"KONG_DATABASE=off",
 					"KONG_DECLARATIVE_CONFIG=/home/kong/kong.yml",
 					"KONG_DNS_ORDER=LAST,A,CNAME", // https://github.com/supabase/cli/issues/14
-					"KONG_PLUGINS=request-transformer,cors",
+					"KONG_PLUGINS=request-transformer,cors,pre-function",
 					fmt.Sprintf("KONG_PORT_MAPS=%d:8000", utils.Config.Api.Port),
 					// Need to increase the nginx buffers in kong to avoid it rejecting the rather
 					// sizeable response headers azure can generate
diff --git a/internal/start/templates/kong.yml b/internal/start/templates/kong.yml
index 0c185eb6e..51de9e091 100644
--- a/internal/start/templates/kong.yml
+++ b/internal/start/templates/kong.yml
@@ -228,6 +228,30 @@ services:
           - /pooler/v2/
     plugins:
       - name: cors
+      - name: request-transformer
+        config:
+          replace:
+            headers:
+              - "Authorization: {{ .BearerToken }}"
+  - name: oauth-protected-resource
+    _comment: "OAuth Protected Resource: /.well-known/oauth-protected-resource/functions/v1/<function-name>/* -> /<function-name>/.well-known/oauth-protected-resource"
+    url: http://{{ .EdgeRuntimeId }}:8081/
+    routes:
+      - name: oauth-protected-resource
+        strip_path: false
+        paths:
+          - /.well-known/oauth-protected-resource/functions/v1/
+    plugins:
+      - name: cors
+      - name: pre-function
+        config:
+          access:
+            - |
+              local uri = kong.request.get_path()
+              local path_after_prefix = uri:gsub("^/.well%-known/oauth%-protected%-resource/functions/v1/", "")
+              local function_name = path_after_prefix:match("^([^/]+)")
+              local new_uri = "/" .. function_name .. "/.well-known/oauth-protected-resource"
+              kong.service.request.set_path(new_uri)
   - name: mcp
     _comment: "MCP: /mcp -> http://studio:3000/api/mcp"
     url: http://{{ .StudioId }}:3000/api/mcp