sylius-mcp-oauth — access is delegated, never autonomous.

A token that represents nobody cannot be revoked either

Access here is delegated, never autonomous: a token always represents an administrator and reaches exactly as far as their permissions. That answers every question about authorisation up front, without a second permission model appearing alongside the one Sylius already has — and revocation as well: the moment the administrator loses their permissions, the token loses them too. A client with its own identity, independent of any staff member, would by contrast be an access path that survives a change of personnel, because nobody has tied it to an account.

PKCE is mandatory, not optional. That follows from dynamic client registration per RFC 7591: whoever may register at runtime is unknown at deployment time — so there is no curated list of trusted clients an exception could rest on. Under those conditions an optional PKCE would be the same as no PKCE, because the attacker gets to pick the option.

The URLs in the metadata per RFC 8414 and RFC 9728 come from the channel, not from the request. If TLS terminates at the ingress, the request reports the internal host and the internal scheme — the issuer in the document then points to an address that does not exist from the outside. A client that compares the issuer as required will discard a perfectly valid token as a result. The error occurs only behind a reverse proxy, so never locally and always in production.