Clerk and similar providers bind DCR clients to only the scopes declared at registration. Authorize then requests scopes_supported (including openid), which rejects with "client is not allowed to request scope 'openid'". Match Claude Code by sending config.scopes as RFC 7591 scope on the DCR body.