songkeys

My questions: 1. Is it expected that Supabase Auth custom domains still return the project-ref URL as the OAuth/OIDC `issuer`? 2. If yes, should an OAuth client discover Supabase via the project-ref URL instead of the custom domain, even when the custom domain is active? 3. Is there a supported way to make the OAuth issuer metadata use the custom Auth domain? 4. Could this issuer/custom-domain mismatch cause a strict OAuth client to complete the browser consent step but then reject the token exchange / not attach a bearer token to the MCP request? I’m intentionally omitting real domains/project refs here, but happy to DM exact URLs to Supabase staff if helpful. Just trying to understand the expected custom-domain behavior for OAuth metadata.