mrambossekandClaude Fable 5
c7750fbf0b
Authentik derives the issuer from the application slug, so two applications mean two issuers - and a token's `iss` must match whoever signed it. A single pinned issuer could therefore only ever serve one of the two clients. So there is a verifier per issuer, and each accepts only the client belonging to it. That is tighter than the previous arrangement as well as more general: a token minted for the phone cannot be replayed at the admin login, and vice versa, because they arrive at different verifiers with different audiences. ECHOLOT_OIDC_APP_ISSUER is optional - empty means both clients share ECHOLOT_OIDC_ISSUER, which is what IdPs with one global issuer do. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>