The AS is supposed to return an error if the CIMD is invalid for some reason, in particular if the client_id URL doesn't match.
This could happen in a token request (client credentials grant), a PAR request, or an authorization request. In an authorization request it is important to not redirect back to the client since the client is invalid. But for a token request or PAR request we should define the specific error to return in JSON.
The AS is supposed to return an error if the CIMD is invalid for some reason, in particular if the
client_idURL doesn't match.This could happen in a token request (client credentials grant), a PAR request, or an authorization request. In an authorization request it is important to not redirect back to the client since the client is invalid. But for a token request or PAR request we should define the specific error to return in JSON.