> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Frequently asked questions

> Frequently asked questions about Connected Apps.

## I'm getting an issuer mismatch error (RFC 9207). How can I ensure the `iss` in the authorization response and tokens match?

By default, the `iss` parameter in the authorization response will use your Project ID (e.g. `stytch.com/project-live-xxx`), whereas Connected Apps access/refresh tokens will use the [default Stytch domain for your Project](https://stytch.com/docs/resources/branding/custom-domains.md#default-project-domains) for the `iss` claim (e.g. `https://{noun}-{verb}-{number}.customers.stytch.com`).

In order to ensure these match and are RFC 9207-compliant, you will need to configure a [custom auth domain](https://stytch.com/docs/resources/branding/custom-domains.md) for your Project and [configure calls to be made over that domain](https://stytch.com/docs/connected-apps/resources/custom-domains.md#configuring-stytch-sdks-to-use-your-domain).

See [custom domains](https://stytch.com/docs/connected-apps/resources/custom-domains.md) for more information on how custom domains impact the issuer.

## I'm seeing `too_many_connected_apps` errors when registering clients, how do I resolve this?

This typically happens with CLI agents and [DCR](https://stytch.com/docs/connected-apps/oauth-learn-more/client-types.md#dynamic-client-registration). Stytch dedupes Public clients by [hashing the client metadata](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/dynamic-client-registration.md#client-deduplication), but because CLI agents often register themselves as [Confidential clients](https://stytch.com/docs/connected-apps/oauth-learn-more/client-types.md#confidential-clients), we issue a unique client secret, resulting in a unique client for each.\
This is a known limitation with the inherent design of DCR; see [this MCP blog post](https://blog.modelcontextprotocol.io/posts/client_registration/#challenge-1-operational-limitations-of-dynamic-client-registration) and [Anthropic's documentation](https://claude.com/docs/connectors/building/authentication#dcr-and-cimd-details) for more details.

To prevent this from occurring, we generally recommend enabling [CIMD](https://stytch.com/docs/connected-apps/oauth-learn-more/client-types.md#client-id-metadata-documents-beta), which always registers clients as [Third-Party Public](https://stytch.com/docs/connected-apps/oauth-learn-more/client-types.md).
This makes it so that instead of 100 unique ChatGPT clients, for example, you should only have 1. Many MCP clients will prefer CIMD, and fall back to DCR.

If you need to clean up existing clients, use the [Search API](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/search-connected-apps.md) and [delete them](https://stytch.com/docs/api-reference/consumer/api/connected-apps/application-management/delete-connected-app.md) as needed.\
You can [use this endpoint](https://stytch.com/docs/api-reference/consumer/api/connected-apps/consent-management/get-connected-apps-user.md) to filter to Connected Apps which have had a successful authorization flow for a User (or [by Org](https://stytch.com/docs/api-reference/b2b/api/connected-apps/consent-management/get-connected-apps-organization.md) or [by Member](https://stytch.com/docs/api-reference/b2b/api/connected-apps/consent-management/get-connected-apps-member.md) for B2B).