Pre-registered clients and PKCE. Login stays in the IdP.

How a remote server proves who is calling: the discovery chain, resource indicators that bind a token to one server, and the passthrough ban that stops a confused deputy