I’m getting an issuer mismatch error (RFC 9207). How can I ensure the iss in the authorization response and tokens match?
By default, the iss parameter in the authorization response will use your Project ID (e.g. stytch.com/project-live-xxx), whereas Connected Apps access/refresh tokens will use the default Stytch domain for your Project for the iss claim (e.g. https://{noun}-{verb}-{number}.customers.stytch.com).
In order to ensure these match and are RFC 9207-compliant, you will need to configure a custom auth domain for your Project and configure calls to be made over that domain.
See custom domains for more information on how custom domains impact the issuer.
I’m seeing too_many_connected_apps errors when registering clients, how do I resolve this?
This typically happens with CLI agents and DCR. Stytch dedupes Public clients by hashing the client metadata, but because CLI agents often register themselves as Confidential clients, we issue a unique client secret, resulting in a unique client for each.This is a known limitation with the inherent design of DCR; see this MCP blog post and Anthropic’s documentation for more details. To prevent this from occurring, we generally recommend enabling CIMD, which always registers clients as Third-Party Public. This makes it so that instead of 100 unique ChatGPT clients, for example, you should only have 1. Many MCP clients will prefer CIMD, and fall back to DCR. If you need to clean up existing clients, use the Search API and delete them as needed.
You can use this endpoint to filter to Connected Apps which have had a successful authorization flow for a User (or by Org or by Member for B2B).