The protected resource's identifier URL. It must be an HTTPS URL with a host, no userinfo, no query, and no fragment.