Auth — 2026 client-side requirements

[maxisbey]

Tracks: #2801 #2800 #2783 #2798 #2795

Spec-compliant client-side OAuth changes for the release. Independent of the protocol-version work; design choices are the implementer's.

What's in it

• Validate iss on the OAuth callback (RFC 9207 / SEP-2468).
• Bind stored credentials to the issuer; re-register on AS change (SEP-2352).
• Send application_type on DCR (SEP-837).
• Union scopes on step-up re-authorization (SEP-2350).
• Confirm and close out offline_access (SEP-2207 — already implemented).
• Server-side SHOULDs (PRM offline_access, single-challenge scopes): docs note / out of scope for this release.

Conformance

• auth/iss-* (×6)
• auth/metadata-issuer-mismatch
• auth/authorization-server-migration
• auth/offline-access-not-supported
• auth/scope-step-up

Dependencies

• Depends on: none

References

• Authorization
• SEP-2468
• SEP-2352
• SEP-837
• SEP-2350
• SEP-2207
• python-sdk #2801
• python-sdk #2800

[maxisbey]

Done via #2921 / #2930 / #2931 / #2933 (the auth bundle) and #2988 (SEP-990 identity assertion). Client auth conformance is green.

_{AI Disclaimer}

[tarunag10]

Opened a targeted regression-fix PR: #3012

It tightens WWW-Authenticate auth-param parsing so scope / resource_metadata only match complete parameter names, with tests for prefixed names like error_scope.