mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-20 20:26:55 -05:00
OIDC Registration §2 / MCP 2026-07-28 (SEP-837): when a registration declares application_type, redirect URIs are constrained to what the declared type allows — native clients may use custom schemes, loopback http redirects, or claimed https links, while web clients require https on non-loopback hosts. Only enforced when the parameter is explicit, so existing registrations keep working. The field round-trips through client metadata and is echoed in the registration response. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QbU1ZgRHK5A1btqpdR5gbD