SEP-2352 clarifies that client credentials are bound to the authorization server that issued them: when PRM authorization_servers changes to a new issuer, clients MUST re-register with the new AS and MUST NOT reuse the previous AS's client credentials.
No existing scenario swaps the AS mid-flow, so this needs a new scenario with two auth servers and a mutable PRM. The wire-observable surface: AS₂ asserts it received a fresh /register and never saw AS₁'s client_id at /authorize or /token. The internal-state requirements ('maintain separate state', 'key by issuer', 'surface an error') are not protocol-observable.
Spec: authorization §authorization-server-binding
SEP-2352 clarifies that client credentials are bound to the authorization server that issued them: when PRM
authorization_serverschanges to a new issuer, clients MUST re-register with the new AS and MUST NOT reuse the previous AS's client credentials.No existing scenario swaps the AS mid-flow, so this needs a new scenario with two auth servers and a mutable PRM. The wire-observable surface: AS₂ asserts it received a fresh
/registerand never saw AS₁'sclient_idat/authorizeor/token. The internal-state requirements ('maintain separate state', 'key by issuer', 'surface an error') are not protocol-observable.Spec: authorization §authorization-server-binding