barnabyI admit that I’ve not read the entire OAuth2 spec, but interpreted the first paragraph of that issue you linked as IA not being compatible/compliant/consistent due to a) allowing empty scope and b) allowing access tokens to be redeemed at the authorization endpoint
