SEP-837 requires MCP clients to specify an appropriate application_type (native or web) during Dynamic Client Registration so OIDC authorization servers can apply the correct redirect-URI constraints.
Only presence + value validity is wire-observable — the harness can't determine the client's true class out-of-band, so the class-specific SHOULDs are excluded.
Spec: authorization §application-type-and-redirect-uri-constraints
Host: the shared createAuthServer DCR handler — fires in every auth scenario that performs DCR; no new scenario.
SEP-837 requires MCP clients to specify an appropriate
application_type(nativeorweb) during Dynamic Client Registration so OIDC authorization servers can apply the correct redirect-URI constraints.Only presence + value validity is wire-observable — the harness can't determine the client's true class out-of-band, so the class-specific SHOULDs are excluded.
Spec: authorization §application-type-and-redirect-uri-constraints
Host: the shared
createAuthServerDCR handler — fires in every auth scenario that performs DCR; no new scenario.