diff --git a/README.md b/README.md
index 7e4202c..49bcdce 100644
--- a/README.md
+++ b/README.md
@@ -27,11 +27,11 @@ Instructions checked against official documentation on **October 20, 2026**. App
 
 1. Open **Customize > Connectors**, then **+ Add > Add custom connector**.
 2. Enter **Are.na** and `https://mcp.are.na/mcp`, then continue.
-3. Review the detected OAuth settings. Choose **Sign in now** and, if shown, **Register automatically** under **OAuth client**.
-4. Finish adding the connector and sign in to Are.na. Select **Connect** if sign-in has not started.
+3. Review the detected OAuth settings. Choose **Sign in now** and, if shown, **Use Claude's published identity** under **OAuth client**. **Register automatically** is also supported.
+4. Finish adding the connector, review the app and permissions on the Are.na connection screen, then sign in to Are.na. Select **Connect** if sign-in has not started.
 5. Enable Are.na in the conversation's connectors menu.
 
-The server currently supports automatic registration (DCR), not **Use Claude's published identity**. In older dialogs with optional OAuth Client ID and Secret fields, leave both blank.
+The server supports Claude's published identity (CIMD) and automatic registration (DCR). In older dialogs with optional OAuth Client ID and Secret fields, leave both blank.
 
 On Team or Enterprise, an authorized administrator must add the connector under **Organization settings > Connectors** first; each member then connects their own Are.na account. Claude currently allows one custom connector on Free accounts.
 
@@ -41,7 +41,7 @@ On Team or Enterprise, an authorized administrator must add the connector under
 
 1. Open [ChatGPT Plugins](https://chatgpt.com/plugins), select **+**, then **Add custom MCP server**.
 2. Name it **Are.na**. Suggested description: “Search Are.na, explore channels, and save and organize blocks.”
-3. Enter `https://mcp.are.na/mcp` as the public server URL and choose **OAuth**. Use dynamic client registration if a registration choice is shown; no client ID or secret needs to be supplied manually.
+3. Enter `https://mcp.are.na/mcp` as the public server URL and choose **OAuth**. Published client identity (CIMD) and dynamic registration (DCR) are supported; no client ID or secret needs to be supplied manually.
 4. Review the permissions and warning, then select **Create as a plugin**. Complete Are.na sign-in when prompted.
 5. Review the discovered tools and install the resulting plugin. In a new chat, type **@** and select **Are.na**.
 
@@ -122,7 +122,7 @@ Then try a channel you know:
 
 - Use the full `https://mcp.are.na/mcp` URL, including `/mcp`, and select Streamable HTTP if asked for a transport.
 - If tools are missing, check that Are.na is connected and enabled in the chat. In ChatGPT, refresh the custom connection's metadata and start a new chat after server updates.
-- If sign-in fails with an unknown client, choose automatic registration in Claude and reconnect. The current server does not support published client identities (CIMD).
+- If sign-in fails with an unknown or invalid client, remove and re-add the connection so the app registers again. Published client identities (CIMD) are supported for Claude and ChatGPT; other apps register automatically.
 - If a workspace hides custom-server setup, its administrator needs to enable or provision the connection.
 
 ## Advanced: local server and access tokens
@@ -254,13 +254,24 @@ Generated output schemas preserve the OpenAPI success-response contracts and inc
 
 The server uses the MCP SDK's low-level tool handlers to publish JSON Schemas directly, with Zod for input parsing and a Workers-compatible JSON Schema validator for outputs.
 
+## OAuth behavior
+
+The hosted server is an OAuth authorization server for MCP clients and delegates sign-in to Are.na.
+
+- **Scopes:** `read`, `write`, or both. Omitting `scope` requests `write`; unknown or empty scopes are rejected. The token response reports the scope Are.na granted, and the Are.na API enforces it.
+- **Consent:** Before Are.na sign-in, a consent screen shows the app, the requested access, and where the user will return. Consent and the callback must happen in the same browser. Redirects back to the app include the `iss` parameter.
+- **Dynamic client registration (DCR):** Clients register as public clients (`none`, with PKCE) or with `client_secret_post`, the default when no method is given. Redirect URIs must use HTTPS, loopback HTTP, or a private-use scheme such as `cursor://`. Token exchange verifies the client, its secret when one was issued, and PKCE. `redirect_uri` is optional at token exchange but must match exactly when supplied.
+- **Client ID metadata documents (CIMD):** Only Claude (`https://claude.ai/oauth/mcp-oauth-client-metadata`) and ChatGPT (`https://chatgpt.com/oauth/client.json` and `https://chatgpt.com/oauth/{callback_id}/client.json`) are trusted; adding another requires a code change. A document must match its URL, list the callback, and support public-client authentication (`none`). Fetches time out after five seconds, are limited to 32 KiB, never follow redirects, and are cached only when the response allows, for at most five minutes.
+
+Known limitations: authorization state and codes are stored in Workers KV, which is eventually consistent and has no atomic consume, so single-use codes are not guaranteed under concurrent redemption. Access tokens are Are.na tokens passed through to the client rather than separate MCP-audience tokens.
+
 ## Making installation easier (maintainers)
 
-The recommended product flow is: choose an app, install Are.na, and sign in. The hosted endpoint already implements OAuth discovery, dynamic client registration, and PKCE. A local package or desktop extension is not needed for that flow.
+The recommended product flow is: choose an app, install Are.na, and sign in. The hosted endpoint already implements OAuth discovery, client registration (DCR and CIMD), consent, and PKCE. A local package or desktop extension is not needed for that flow.
 
 Recommended next steps, in order:
 
-1. **Verify complete installs and improve authentication compatibility.** Test a fresh account connection, a read, an explicitly approved write, and reconnect in each supported app. Add CIMD support so clients can use their published OAuth identities; until then, keep DCR as the documented choice. Review scope handling and client validation before expanding distribution. The current authorization route defaults upstream access to `write` when no scope is supplied, while the token response defaults its reported scope to `read`; those defaults need to agree.
+1. **Verify complete installs.** Test a fresh account connection, consent, a read, an explicitly approved write, and reconnect in each supported app. See [OAuth behavior](#oauth-behavior).
 2. **Add tool annotations before directory submission.** The tool registry currently publishes descriptions and input/output schemas, but no `readOnlyHint`, `destructiveHint`, or `openWorldHint`. Classify each tool by its actual behavior, including composite tools, and verify the advertised values. See [OpenAI's MCP review requirements](https://developers.openai.com/plugins/deploy/app-review).
 3. **Submit to the app directories.** These listings would let users find Are.na by name and install it without pasting a server URL. Prepare branding, support and privacy URLs, a reviewer account, and representative prompts. Submission and publication are separate from updating these docs:
 
diff --git a/src/__tests__/http-transport.test.ts b/src/__tests__/http-transport.test.ts
index ae41c10..aa9e49f 100644
--- a/src/__tests__/http-transport.test.ts
+++ b/src/__tests__/http-transport.test.ts
@@ -188,7 +188,7 @@ describe("Authorization endpoint", () => {
       client_id: clientId,
       redirect_uri: "http://localhost:3000/callback",
       response_type: "token",
-      code_challenge: "abc",
+      code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
       code_challenge_method: "S256",
     });
     const req = makeRequest("GET", `/authorize?${params}`);
@@ -203,7 +203,7 @@ describe("Authorization endpoint", () => {
       client_id: "nonexistent",
       redirect_uri: "http://localhost:3000/callback",
       response_type: "code",
-      code_challenge: "abc",
+      code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
       code_challenge_method: "S256",
     });
     const req = makeRequest("GET", `/authorize?${params}`);
@@ -211,7 +211,7 @@ describe("Authorization endpoint", () => {
     expect(res.status).toBe(401);
   });
 
-  it("redirects to Are.na OAuth on valid authorize request", async () => {
+  it("requests client consent on valid authorize request", async () => {
     const clientId = await getRegisteredClientId();
     const params = new URLSearchParams({
       client_id: clientId,
@@ -223,12 +223,8 @@ describe("Authorization endpoint", () => {
     });
     const req = makeRequest("GET", `/authorize?${params}`);
     const res = await app.fetch(req, env);
-    expect(res.status).toBe(302);
-
-    const location = res.headers.get("Location")!;
-    expect(location).toContain("www.are.na/oauth/authorize");
-    expect(location).toContain("client_id=test-arena-client-id");
-    expect(location).toContain("response_type=code");
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain("Continue to Are.na");
   });
 });
 
@@ -250,7 +246,7 @@ describe("Token endpoint", () => {
     expect(data.error).toBe("unsupported_grant_type");
   });
 
-  it("rejects invalid authorization code", async () => {
+  it("rejects incomplete token exchange parameters", async () => {
     const body = new URLSearchParams({
       grant_type: "authorization_code",
       code: "invalid-code",
@@ -264,6 +260,6 @@ describe("Token endpoint", () => {
     const res = await app.fetch(req, makeEnv());
     expect(res.status).toBe(400);
     const data = (await res.json()) as { error: string };
-    expect(data.error).toBe("invalid_grant");
+    expect(data.error).toBe("invalid_request");
   });
 });
diff --git a/src/__tests__/oauth.test.ts b/src/__tests__/oauth.test.ts
new file mode 100644
index 0000000..ae2767c
--- /dev/null
+++ b/src/__tests__/oauth.test.ts
@@ -0,0 +1,755 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import app from "../transports/http";
+import { OAuthStore } from "../auth/store";
+
+const ORIGIN = "https://mcp.are.na";
+const REDIRECT = "http://127.0.0.1:3000/callback";
+const VERIFIER = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
+const CHALLENGE = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
+const CLAUDE = "https://claude.ai/oauth/mcp-oauth-client-metadata";
+const CHATGPT = "https://chatgpt.com/oauth/client.json";
+
+function environment() {
+  const data = new Map<string, string>();
+  const kv = {
+    get: vi
+      .fn()
+      .mockImplementation(async (key: string) => data.get(key) ?? null),
+    put: vi.fn(async (key: string, value: string) => {
+      data.set(key, value);
+    }),
+    delete: vi.fn(async (key: string) => {
+      data.delete(key);
+    }),
+    list: vi.fn(),
+    getWithMetadata: vi.fn(),
+  };
+  return {
+    OAUTH_KV: kv,
+    ARENA_OAUTH_CLIENT_ID: "arena-app-id",
+    ARENA_OAUTH_CLIENT_SECRET: "arena-app-secret",
+  };
+}
+
+type Client = { client_id: string; client_secret?: string };
+let env: ReturnType<typeof environment>;
+const fetchMock = vi.fn<typeof fetch>();
+
+beforeEach(() => {
+  env = environment();
+  fetchMock.mockReset();
+  vi.stubGlobal("fetch", fetchMock);
+});
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+function request(path: string, init?: RequestInit) {
+  return app.fetch(new Request(ORIGIN + path, init), env);
+}
+function post(
+  path: string,
+  body: Record<string, string>,
+  headers: Record<string, string> = {},
+) {
+  return request(path, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...headers,
+    },
+    body: new URLSearchParams(body),
+  });
+}
+async function register(metadata: Record<string, unknown> = {}) {
+  const response = await request("/register", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      redirect_uris: [REDIRECT],
+      client_name: "Test app",
+      ...metadata,
+    }),
+  });
+  expect(response.status).toBe(201);
+  return (await response.json()) as Client;
+}
+async function authorize(
+  client: Client,
+  overrides: Record<string, string> = {},
+) {
+  return request(
+    `/authorize?${new URLSearchParams({
+      client_id: client.client_id,
+      redirect_uri: REDIRECT,
+      response_type: "code",
+      code_challenge: CHALLENGE,
+      code_challenge_method: "S256",
+      state: "original-client-state",
+      ...overrides,
+    })}`,
+  );
+}
+async function consent(client: Client, overrides: Record<string, string> = {}) {
+  const response = await authorize(client, overrides);
+  expect(response.status).toBe(200);
+  const cookie = response.headers.get("Set-Cookie")!.split(";")[0];
+  const page = await response.text();
+  const state = /name="state" value="([a-f0-9]+)"/.exec(page)![1];
+  const result = await post(
+    "/authorize/consent",
+    { state, decision: "allow" },
+    { Cookie: cookie, Origin: ORIGIN },
+  );
+  expect(result.status).toBe(302);
+  return { state, cookie, upstream: new URL(result.headers.get("Location")!) };
+}
+async function issueCode(
+  client: Client,
+  options: { scope?: string; tokenScope?: string; redirect?: string } = {},
+) {
+  const flow = await consent(client, {
+    ...(options.scope !== undefined ? { scope: options.scope } : {}),
+    ...(options.redirect ? { redirect_uri: options.redirect } : {}),
+  });
+  fetchMock.mockResolvedValueOnce(
+    Response.json({
+      access_token: "arena-user-token",
+      ...(options.tokenScope !== undefined
+        ? { scope: options.tokenScope }
+        : {}),
+    }),
+  );
+  const response = await request(
+    `/callback?code=upstream-code&state=${flow.state}`,
+    { headers: { Cookie: flow.cookie } },
+  );
+  expect(response.status).toBe(302);
+  const location = new URL(response.headers.get("Location")!);
+  expect(location.searchParams.get("iss")).toBe(ORIGIN);
+  expect(location.searchParams.get("state")).toBe("original-client-state");
+  const code = location.searchParams.get("code")!;
+  expect(code).toBeTruthy();
+  return { code, flow };
+}
+function exchange(
+  client: Client,
+  code: string,
+  overrides: Record<string, string> = {},
+) {
+  return post("/token", {
+    grant_type: "authorization_code",
+    client_id: client.client_id,
+    code,
+    code_verifier: VERIFIER,
+    redirect_uri: REDIRECT,
+    ...(client.client_secret ? { client_secret: client.client_secret } : {}),
+    ...overrides,
+  });
+}
+function metadata(clientId = CLAUDE, overrides: Record<string, unknown> = {}) {
+  return {
+    client_id: clientId,
+    client_name: "Published app",
+    redirect_uris: [REDIRECT],
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "none",
+    ...overrides,
+  };
+}
+function mockMetadata(
+  body = metadata(),
+  headers: Record<string, string> = { "Cache-Control": "public, max-age=300" },
+) {
+  fetchMock.mockResolvedValueOnce(Response.json(body, { headers }));
+}
+
+describe("OAuth scopes through authorization, callback, and token exchange", () => {
+  it.each([
+    [undefined, "write"],
+    ["read", "read"],
+    ["write", "write"],
+    ["write read write", "read write"],
+  ])("keeps requested scope %s consistent", async (scope, expected) => {
+    const client = await register();
+    const { code, flow } = await issueCode(client, { scope });
+    expect(flow.upstream.searchParams.get("scope")).toBe(expected);
+    const response = await exchange(client, code);
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      access_token: "arena-user-token",
+      token_type: "Bearer",
+      scope: expected,
+    });
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+    expect((await exchange(client, code)).status).toBe(400);
+  });
+
+  it.each(["", "openid", "read admin", "READ", "read\twrite"])(
+    "rejects unsupported scope %j before saving a flow",
+    async (scope) => {
+      const client = await register();
+      const response = await authorize(client, { scope });
+      expect(await response.json()).toMatchObject({ error: "invalid_scope" });
+      expect(fetchMock).not.toHaveBeenCalled();
+    },
+  );
+
+  it("reports a narrower scope returned by Are.na", async () => {
+    const client = await register();
+    const { code } = await issueCode(client, {
+      scope: "read write",
+      tokenScope: "read",
+    });
+    expect(await (await exchange(client, code)).json()).toMatchObject({
+      scope: "read",
+    });
+  });
+
+  it("rejects unexpected scope escalation from upstream", async () => {
+    const client = await register();
+    const flow = await consent(client, { scope: "read" });
+    fetchMock.mockResolvedValueOnce(
+      Response.json({ access_token: "token", scope: "write" }),
+    );
+    const response = await request(
+      `/callback?state=${flow.state}&code=upstream`,
+      { headers: { Cookie: flow.cookie } },
+    );
+    const url = new URL(response.headers.get("Location")!);
+    expect(url.searchParams.get("error")).toBe("server_error");
+    expect(url.searchParams.has("code")).toBe(false);
+  });
+
+  it("reports the real write scope of legacy in-flight codes", async () => {
+    const client = await register();
+    await new OAuthStore(env.OAUTH_KV).putAuthCode("legacy-code", {
+      arena_access_token: "legacy-token",
+      client_id: client.client_id,
+      redirect_uri: REDIRECT,
+      code_challenge: CHALLENGE,
+      code_challenge_method: "S256",
+    });
+    expect(await (await exchange(client, "legacy-code")).json()).toMatchObject({
+      scope: "write",
+    });
+  });
+});
+
+describe("client registration and token binding", () => {
+  it.each([
+    { redirect_uris: [123] },
+    { redirect_uris: [] },
+    { redirect_uris: ["javascript:alert(1)"] },
+    { redirect_uris: ["JavaScript://app.example/%0Aalert(1)"] },
+    { redirect_uris: ["data:text/html,callback"] },
+    { redirect_uris: ["https://app.example/callback#fragment"] },
+    { redirect_uris: ["https://user:password@app.example/callback"] },
+    { redirect_uris: ["https://*.example/callback"] },
+    { redirect_uris: ["http://public.example/callback"] },
+    { client_name: {} },
+    { token_endpoint_auth_method: "client_secret_basic" },
+    { grant_types: ["client_credentials"] },
+    { response_types: ["token"] },
+  ])("rejects malformed or unsupported metadata: %j", async (metadata) => {
+    const response = await request("/register", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ redirect_uris: [REDIRECT], ...metadata }),
+    });
+    expect(response.status).toBe(400);
+    expect(await response.json()).toMatchObject({
+      error: "invalid_client_metadata",
+    });
+  });
+
+  it("returns a registration error for malformed JSON", async () => {
+    const response = await request("/register", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{",
+    });
+    expect(response.status).toBe(400);
+  });
+
+  it.each([
+    "https://app.example/callback",
+    "http://localhost:4321/callback",
+    "http://[::1]:4321/callback",
+    "cursor://anysphere.cursor-mcp/oauth/callback",
+  ])("supports callback %s", async (redirect) => {
+    await register({ redirect_uris: [redirect] });
+  });
+
+  it("honors public DCR clients without generating a secret", async () => {
+    const client = await register({ token_endpoint_auth_method: "none" });
+    expect(client.client_secret).toBeUndefined();
+    const { code } = await issueCode(client);
+    expect(
+      (await exchange(client, code, { client_secret: "unexpected" })).status,
+    ).toBe(401);
+    expect((await exchange(client, code)).status).toBe(200);
+  });
+
+  it("requires confidential client credentials, including legacy registrations", async () => {
+    const client = await register();
+    const store = new OAuthStore(env.OAUTH_KV);
+    const saved = (await store.getClient(client.client_id))!;
+    delete saved.token_endpoint_auth_method;
+    await store.putClient(saved);
+    const { code } = await issueCode(client);
+    expect((await exchange({ client_id: client.client_id }, code)).status).toBe(
+      401,
+    );
+    expect(
+      (await exchange(client, code, { client_secret: "wrong" })).status,
+    ).toBe(401);
+    expect((await exchange(client, code)).status).toBe(200);
+  });
+
+  it("accepts OAuth 2.1 token exchange without a redundant redirect_uri", async () => {
+    const client = await register({ token_endpoint_auth_method: "none" });
+    const { code } = await issueCode(client);
+    const response = await post("/token", {
+      grant_type: "authorization_code",
+      client_id: client.client_id,
+      code,
+      code_verifier: VERIFIER,
+    });
+    expect(response.status).toBe(200);
+  });
+
+  it("binds authorization codes to the client even when PKCE and redirect match", async () => {
+    const client = await register();
+    const other = await register();
+    const { code } = await issueCode(client);
+    expect(await (await exchange(other, code)).json()).toMatchObject({
+      error: "invalid_grant",
+    });
+    expect((await exchange(client, code)).status).toBe(200);
+  });
+
+  it.each<Record<string, string>>([
+    { client_id: "" },
+    { redirect_uri: "" },
+    { redirect_uri: "https://attacker.example/callback" },
+    { code_verifier: "short" },
+    { code_verifier: "x".repeat(43) },
+    { resource: "https://another-resource.example/mcp" },
+    { client_assertion: "unverified-jwt" },
+  ])(
+    "rejects invalid token requests without consuming the code: %j",
+    async (overrides) => {
+      const client = await register();
+      const { code } = await issueCode(client);
+      const response = await exchange(client, code, overrides);
+      expect(response.status).toBeGreaterThanOrEqual(400);
+      expect((await exchange(client, code)).status).toBe(200);
+    },
+  );
+
+  it.each<Record<string, string>>([
+    { code_challenge_method: "" },
+    { code_challenge_method: "plain" },
+    { code_challenge: "short" },
+    { redirect_uri: "https://attacker.example" },
+    { resource: "https://wrong.example" },
+  ])("rejects invalid authorization parameters: %j", async (overrides) => {
+    expect((await authorize(await register(), overrides)).status).toBe(400);
+  });
+});
+
+describe("browser consent and callbacks", () => {
+  it("shows the client and destination with escaped untrusted text", async () => {
+    const client = await register({
+      client_name: '<script>alert("x")</script>',
+    });
+    const response = await authorize(client);
+    const page = await response.text();
+    expect(page).not.toContain("<script>");
+    expect(page).toContain("&lt;script&gt;");
+    expect(page).toContain(REDIRECT);
+    expect(page).toContain(client.client_id);
+    expect(response.headers.get("Content-Security-Policy")).toContain(
+      "frame-ancestors 'none'",
+    );
+    expect(response.headers.get("Referrer-Policy")).toBe("same-origin");
+    expect(response.headers.get("Set-Cookie")).toContain("HttpOnly");
+    expect(response.headers.get("Set-Cookie")).toContain("Secure");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("requires the browser cookie and same-origin form submission", async () => {
+    const response = await authorize(await register());
+    const cookie = response.headers.get("Set-Cookie")!.split(";")[0];
+    const state = /name="state" value="([a-f0-9]+)"/.exec(
+      await response.text(),
+    )![1];
+    expect(
+      (
+        await post(
+          "/authorize/consent",
+          { state, decision: "allow" },
+          { Origin: ORIGIN },
+        )
+      ).status,
+    ).toBe(400);
+    expect(
+      (
+        await post(
+          "/authorize/consent",
+          { state, decision: "allow" },
+          { Origin: "https://evil.example", Cookie: cookie },
+        )
+      ).status,
+    ).toBe(400);
+    const cancelled = await post(
+      "/authorize/consent",
+      { state, decision: "deny" },
+      { Origin: ORIGIN, Cookie: cookie },
+    );
+    const url = new URL(cancelled.headers.get("Location")!);
+    expect(url.searchParams.get("error")).toBe("access_denied");
+    expect(url.searchParams.get("iss")).toBe(ORIGIN);
+    expect(url.searchParams.get("state")).toBe("original-client-state");
+    expect(await new OAuthStore(env.OAUTH_KV).getConsent(state)).toBeNull();
+  });
+
+  it("requires consent and the same browser at callback", async () => {
+    const client = await register();
+    const response = await authorize(client);
+    const cookie = response.headers.get("Set-Cookie")!.split(";")[0];
+    const state = /name="state" value="([a-f0-9]+)"/.exec(
+      await response.text(),
+    )![1];
+    expect(
+      (
+        await request(`/callback?state=${state}&code=x`, {
+          headers: { Cookie: cookie },
+        })
+      ).status,
+    ).toBe(400);
+    await post(
+      "/authorize/consent",
+      { state, decision: "allow" },
+      { Cookie: cookie, Origin: ORIGIN },
+    );
+    expect((await request(`/callback?state=${state}&code=x`)).status).toBe(400);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("returns issuer and original state on upstream denial", async () => {
+    const flow = await consent(await register());
+    const response = await request(
+      `/callback?state=${flow.state}&error=access_denied`,
+      { headers: { Cookie: flow.cookie } },
+    );
+    const url = new URL(response.headers.get("Location")!);
+    expect(url.searchParams.get("error")).toBe("access_denied");
+    expect(url.searchParams.get("iss")).toBe(ORIGIN);
+    expect(url.searchParams.get("state")).toBe("original-client-state");
+    expect(
+      (
+        await request(`/callback?state=${flow.state}&error=access_denied`, {
+          headers: { Cookie: flow.cookie },
+        })
+      ).status,
+    ).toBe(400);
+  });
+
+  it("does not expose upstream error payloads", async () => {
+    const flow = await consent(await register());
+    fetchMock.mockResolvedValueOnce(
+      new Response("private upstream debug details", { status: 500 }),
+    );
+    const response = await request(`/callback?state=${flow.state}&code=x`, {
+      headers: { Cookie: flow.cookie },
+    });
+    expect(response.headers.get("Location")).not.toContain("private");
+    expect(
+      new URL(response.headers.get("Location")!).searchParams.get("error"),
+    ).toBe("server_error");
+  });
+});
+
+describe("concurrent sign-ins in one browser", () => {
+  function browser() {
+    const cookies = new Map<string, string>();
+    return {
+      cookies,
+      header: (names = [...cookies.keys()]) =>
+        names.map((name) => `${name}=${cookies.get(name)}`).join("; "),
+      save(response: Response) {
+        const cookie = response.headers.get("Set-Cookie");
+        if (cookie) {
+          const [pair] = cookie.split(";");
+          const name = pair.slice(0, pair.indexOf("="));
+          if (/max-age=0/i.test(cookie)) cookies.delete(name);
+          else cookies.set(name, pair.slice(name.length + 1));
+        }
+        return response;
+      },
+    };
+  }
+  type Browser = ReturnType<typeof browser>;
+
+  async function start(jar: Browser, client: Client, clientState: string) {
+    const response = jar.save(await authorize(client, { state: clientState }));
+    expect(response.status).toBe(200);
+    return /name="state" value="([a-f0-9]+)"/.exec(await response.text())![1];
+  }
+  async function decide(
+    jar: Browser,
+    state: string,
+    decision: string,
+    headers: Record<string, string> = {},
+  ) {
+    return jar.save(
+      await post(
+        "/authorize/consent",
+        { state, decision },
+        { Cookie: jar.header(), Origin: ORIGIN, ...headers },
+      ),
+    );
+  }
+  async function complete(jar: Browser, client: Client, state: string) {
+    fetchMock.mockResolvedValueOnce(
+      Response.json({ access_token: `token-${state}` }),
+    );
+    const response = jar.save(
+      await request(`/callback?code=upstream&state=${state}`, {
+        headers: { Cookie: jar.header() },
+      }),
+    );
+    expect(response.status).toBe(302);
+    const location = new URL(response.headers.get("Location")!);
+    const exchanged = await exchange(
+      client,
+      location.searchParams.get("code")!,
+    );
+    expect(await exchanged.json()).toMatchObject({
+      access_token: `token-${state}`,
+    });
+    return location.searchParams.get("state");
+  }
+
+  it("completes two interleaved flows", async () => {
+    const jar = browser();
+    const client = await register();
+    const first = await start(jar, client, "first");
+    const second = await start(jar, client, "second");
+    expect(jar.cookies.size).toBe(2);
+    expect((await decide(jar, first, "allow")).status).toBe(302);
+    expect((await decide(jar, second, "allow")).status).toBe(302);
+    expect(await complete(jar, client, first)).toBe("first");
+    expect(await complete(jar, client, second)).toBe("second");
+    expect(jar.cookies.size).toBe(0);
+  });
+
+  it("keeps one flow working after another is cancelled", async () => {
+    const jar = browser();
+    const client = await register();
+    const cancelled = await start(jar, client, "cancelled");
+    const kept = await start(jar, client, "kept");
+    const denied = await decide(jar, cancelled, "deny");
+    expect(
+      new URL(denied.headers.get("Location")!).searchParams.get("error"),
+    ).toBe("access_denied");
+    expect(jar.cookies.size).toBe(1);
+    expect((await decide(jar, kept, "allow")).status).toBe(302);
+    expect(await complete(jar, client, kept)).toBe("kept");
+  });
+
+  it("rejects another flow's cookie and cross-origin submissions", async () => {
+    const jar = browser();
+    const client = await register();
+    const first = await start(jar, client, "first");
+    const second = await start(jar, client, "second");
+    const [firstCookie, secondCookie] = [...jar.cookies.keys()];
+    const firstSwapped = `${firstCookie}=${jar.cookies.get(secondCookie)}`;
+    for (const Cookie of [jar.header([secondCookie]), firstSwapped])
+      expect((await decide(jar, first, "allow", { Cookie })).status).toBe(400);
+    expect(
+      (await decide(jar, first, "allow", { Origin: "https://evil.example" }))
+        .status,
+    ).toBe(400);
+    expect((await decide(jar, second, "allow")).status).toBe(302);
+    expect(
+      (
+        await request(`/callback?code=upstream&state=${second}`, {
+          headers: { Cookie: jar.header([firstCookie]) },
+        })
+      ).status,
+    ).toBe(400);
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect((await decide(jar, first, "allow")).status).toBe(302);
+    expect(await complete(jar, client, second)).toBe("second");
+  });
+});
+
+describe("published client identities", () => {
+  it("advertises CIMD and issuer identification", async () => {
+    expect(
+      await (await request("/.well-known/oauth-authorization-server")).json(),
+    ).toMatchObject({
+      client_id_metadata_document_supported: true,
+      authorization_response_iss_parameter_supported: true,
+    });
+  });
+
+  it.each([
+    CLAUDE,
+    CHATGPT,
+    "https://chatgpt.com/oauth/callback-123/client.json",
+  ])("supports the full flow for %s", async (clientId) => {
+    mockMetadata(
+      metadata(
+        clientId,
+        clientId.includes("chatgpt.com")
+          ? {
+              token_endpoint_auth_method: "private_key_jwt",
+              token_endpoint_auth_methods_supported: [
+                "none",
+                "private_key_jwt",
+              ],
+            }
+          : {},
+      ),
+    );
+    const client = { client_id: clientId };
+    const { code } = await issueCode(client);
+    expect((await exchange(client, code)).status).toBe(200);
+    expect(fetchMock).toHaveBeenCalledTimes(2); // document + upstream token
+    expect(fetchMock.mock.calls[0][1]).toMatchObject({
+      redirect: "manual",
+      headers: { Accept: "application/json" },
+    });
+  });
+
+  it.each([
+    "https://127.0.0.1/client.json",
+    "https://metadata.google.internal/client.json",
+    "http://claude.ai/oauth/mcp-oauth-client-metadata",
+    "https://claude.ai.evil.example/oauth/mcp-oauth-client-metadata",
+    "https://claude.ai@evil.example/oauth/mcp-oauth-client-metadata",
+    "https://chatgpt.com:444/oauth/client.json",
+    "https://chatgpt.com/oauth/client.json?url=http://localhost",
+    "https://chatgpt.com/oauth/../client.json",
+    "https://chatgpt.com/oauth/client.json#fragment",
+  ])(
+    "rejects untrusted metadata URLs without fetching: %s",
+    async (clientId) => {
+      expect((await authorize({ client_id: clientId })).status).toBe(401);
+      expect(fetchMock).not.toHaveBeenCalled();
+    },
+  );
+
+  it.each([
+    { client_id: CHATGPT },
+    { client_name: undefined },
+    { redirect_uris: [123] },
+    { redirect_uris: ["javascript:alert(1)"] },
+    { token_endpoint_auth_method: "private_key_jwt" },
+    { token_endpoint_auth_methods_supported: ["private_key_jwt"] },
+  ])(
+    "rejects invalid or unsupported published metadata: %j",
+    async (overrides) => {
+      mockMetadata(metadata(CLAUDE, overrides));
+      expect((await authorize({ client_id: CLAUDE })).status).toBe(401);
+    },
+  );
+
+  it("does not follow document redirects", async () => {
+    fetchMock.mockResolvedValueOnce(
+      new Response(null, {
+        status: 302,
+        headers: { Location: "http://127.0.0.1/private" },
+      }),
+    );
+    expect((await authorize({ client_id: CLAUDE })).status).toBe(401);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1]?.redirect).toBe("manual");
+  });
+
+  it.each([
+    new Response("not json", {
+      headers: { "Content-Type": "application/json" },
+    }),
+    new Response("x".repeat(32769), {
+      headers: { "Content-Type": "application/json" },
+    }),
+    new Response("<html>not metadata</html>", {
+      headers: { "Content-Type": "text/html" },
+    }),
+  ])("rejects unreadable documents", async (response) => {
+    fetchMock.mockResolvedValueOnce(response);
+    expect((await authorize({ client_id: CLAUDE })).status).toBe(401);
+  });
+
+  it("fails closed on a timed-out metadata fetch", async () => {
+    fetchMock.mockRejectedValueOnce(
+      new DOMException("timeout", "TimeoutError"),
+    );
+    expect((await authorize({ client_id: CLAUDE })).status).toBe(401);
+  });
+
+  describe("when the metadata cache write fails", () => {
+    beforeEach(() => {
+      const put = env.OAUTH_KV.put.getMockImplementation()!;
+      env.OAUTH_KV.put.mockImplementation(async (key, value) => {
+        if (key.startsWith("cimd:")) throw new Error("KV write limit");
+        return put(key, value);
+      });
+    });
+
+    it("still resolves valid metadata", async () => {
+      mockMetadata();
+      const client = { client_id: CLAUDE };
+      const { code } = await issueCode(client);
+      mockMetadata();
+      expect((await exchange(client, code)).status).toBe(200);
+      expect(env.OAUTH_KV.put).toHaveBeenCalledWith(
+        `cimd:${CLAUDE}`,
+        expect.any(String),
+        expect.anything(),
+      );
+    });
+
+    it("still rejects malformed and untrusted metadata", async () => {
+      mockMetadata(metadata(CLAUDE, { redirect_uris: ["javascript:x"] }));
+      expect((await authorize({ client_id: CLAUDE })).status).toBe(401);
+      expect(
+        (await authorize({ client_id: "https://evil.example/client.json" }))
+          .status,
+      ).toBe(401);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  it("refreshes expired metadata and honors removed redirect URIs", async () => {
+    vi.useFakeTimers();
+    mockMetadata();
+    expect((await authorize({ client_id: CLAUDE })).status).toBe(200);
+    vi.advanceTimersByTime(300001);
+    mockMetadata(
+      metadata(CLAUDE, { redirect_uris: ["https://claude.ai/new-callback"] }),
+    );
+    expect((await authorize({ client_id: CLAUDE })).status).toBe(400);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it.each([
+    "no-store",
+    "no-cache, max-age=300",
+    "private, max-age=300",
+    "max-age=30",
+  ])("does not cache %s", async (control) => {
+    mockMetadata(metadata(), { "Cache-Control": control });
+    mockMetadata(metadata(), { "Cache-Control": control });
+    await authorize({ client_id: CLAUDE });
+    await authorize({ client_id: CLAUDE });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/src/auth/clients.ts b/src/auth/clients.ts
new file mode 100644
index 0000000..1632826
--- /dev/null
+++ b/src/auth/clients.ts
@@ -0,0 +1,156 @@
+import { z } from "zod";
+import { OAuthStore, type OAuthClient } from "./store";
+
+// Trust only vendor-controlled metadata endpoints. Do not turn client_id into
+// an arbitrary server-side fetch (including through redirects or DNS aliases).
+export function isTrustedClientMetadataUrl(clientId: string): boolean {
+  return (
+    clientId === "https://claude.ai/oauth/mcp-oauth-client-metadata" ||
+    /^https:\/\/chatgpt\.com\/oauth\/(?:[A-Za-z0-9_-]+\/)?client\.json$/.test(
+      clientId,
+    )
+  );
+}
+
+// Native apps may use private-use schemes (RFC 8252), e.g. cursor://.
+const UNSAFE_SCHEMES = ["javascript:", "data:", "vbscript:", "file:", "blob:"];
+
+export function isValidRedirectUri(value: string): boolean {
+  try {
+    if (!/^[a-z][a-z0-9+.-]*:[^\s\\]+$/i.test(value)) return false;
+    const url = new URL(value);
+    if (
+      url.username ||
+      url.password ||
+      url.hash ||
+      value.includes("#") ||
+      value.includes("*")
+    )
+      return false;
+    if (url.protocol === "http:")
+      return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    return !UNSAFE_SCHEMES.includes(url.protocol);
+  } catch {
+    return false;
+  }
+}
+
+const clientMetadata = z.object({
+  redirect_uris: z
+    .array(z.string().max(2048).refine(isValidRedirectUri))
+    .min(1)
+    .max(20),
+  client_name: z.string().trim().min(1).max(200).optional(),
+  grant_types: z
+    .array(z.string())
+    .refine((types) => types.includes("authorization_code"))
+    .optional(),
+  response_types: z
+    .array(z.string())
+    .refine((types) => types.includes("code"))
+    .optional(),
+});
+
+export const registrationMetadata = clientMetadata.extend({
+  // RFC 7591's client_secret_basic default is unsupported; issue a POST secret.
+  token_endpoint_auth_method: z
+    .enum(["none", "client_secret_post"])
+    .default("client_secret_post"),
+});
+
+const publishedMetadata = clientMetadata.extend({
+  client_id: z.string(),
+  client_name: z.string().trim().min(1).max(200),
+  token_endpoint_auth_method: z.string().optional(),
+  token_endpoint_auth_methods_supported: z.array(z.string()).min(1).optional(),
+});
+
+const MAX_METADATA_BYTES = 32 * 1024;
+
+async function readMetadata(response: Response): Promise<unknown> {
+  if (
+    !response.ok ||
+    !response.headers
+      .get("content-type")
+      ?.split(";")[0]
+      .trim()
+      .match(/^application\/(?:[\w.+-]+\+)?json$/i)
+  ) {
+    await response.body?.cancel();
+    throw new Error("Invalid client metadata response");
+  }
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error("Empty client metadata response");
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_METADATA_BYTES)
+        throw new Error("Client metadata is too large");
+      text += decoder.decode(value, { stream: true });
+    }
+    return JSON.parse(text + decoder.decode());
+  } finally {
+    await reader.cancel();
+  }
+}
+
+function cacheSeconds(headers: Headers): number {
+  const control = headers.get("cache-control") ?? "";
+  if (/(?:^|,)\s*(?:no-store|no-cache|private)(?:\s|,|=|$)/i.test(control))
+    return 0;
+  const match = /(?:^|,)\s*max-age\s*=\s*"?(\d+)"?(?:\s|,|$)/i.exec(control);
+  if (!match) return 0;
+  const age = Number(headers.get("age") ?? 0);
+  if (!Number.isFinite(age) || age < 0) return 0;
+  return Math.max(0, Math.min(300, Number(match[1]) - age));
+}
+
+export async function resolveClient(
+  clientId: string,
+  store: OAuthStore,
+): Promise<OAuthClient | null> {
+  // Generated DCR IDs are opaque hex strings, never URLs.
+  if (/^[a-f0-9]{32}$/.test(clientId)) return store.getClient(clientId);
+  if (!isTrustedClientMetadataUrl(clientId)) return null;
+
+  const cached = await store.getClientMetadata(clientId);
+  if (cached) return cached;
+
+  try {
+    const response = await fetch(clientId, {
+      headers: { Accept: "application/json" },
+      redirect: "manual",
+      signal: AbortSignal.timeout(5000),
+    });
+    const parsed = publishedMetadata.safeParse(await readMetadata(response));
+    if (!parsed.success || parsed.data.client_id !== clientId) return null;
+    const metadata = parsed.data;
+    // ChatGPT publishes a plural list during the CIMD transition. Choose the
+    // intersection with our supported methods; a public document has no secret.
+    const methods = metadata.token_endpoint_auth_methods_supported ?? [
+      metadata.token_endpoint_auth_method ?? "none",
+    ];
+    if (!methods.includes("none")) return null;
+
+    const client: OAuthClient = {
+      client_id: clientId,
+      client_name: metadata.client_name,
+      redirect_uris: metadata.redirect_uris,
+      token_endpoint_auth_method: "none",
+      created_at: Date.now(),
+    };
+    const ttl = cacheSeconds(response.headers);
+    // Caching is best effort; a failed write must not reject a valid client.
+    if (ttl >= 60) await store.putClientMetadata(client, ttl).catch(() => {});
+    return client;
+  } catch {
+    // Unreachable, malformed, redirected, oversized, or timed-out documents
+    // must never authorize a client or fall back to stale metadata.
+    return null;
+  }
+}
diff --git a/src/auth/consent.ts b/src/auth/consent.ts
new file mode 100644
index 0000000..de6726c
--- /dev/null
+++ b/src/auth/consent.ts
@@ -0,0 +1,55 @@
+import { html } from "hono/html";
+import type { OAuthClient } from "./store";
+
+export function consentPage(
+  client: OAuthClient,
+  state: string,
+  redirectUri: string,
+  scope: string,
+) {
+  return html`<!doctype html>
+    <html lang="en">
+      <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>Connect to Are.na</title>
+        <style>
+          body {
+            font:
+              16px/1.5 system-ui,
+              sans-serif;
+            max-width: 36rem;
+            margin: 10vh auto;
+            padding: 1.5rem;
+          }
+          code {
+            overflow-wrap: anywhere;
+          }
+          button {
+            font: inherit;
+            padding: 0.5rem 1rem;
+            margin: 0.5rem 0.5rem 0 0;
+            cursor: pointer;
+          }
+        </style>
+      </head>
+      <body>
+        <h1>Connect to Are.na</h1>
+        <p>
+          <strong>${client.client_name ?? "An app"}</strong> is requesting
+          ${scope.split(" ").includes("write")
+            ? "permission to read and change your Are.na content"
+            : "read access to your Are.na content"}.
+        </p>
+        <p>App identity: <code>${client.client_id}</code></p>
+        <p>After signing in, you will return to <code>${redirectUri}</code>.</p>
+        <form method="post" action="/authorize/consent">
+          <input type="hidden" name="state" value="${state}" />
+          <button name="decision" value="allow" type="submit">
+            Continue to Are.na
+          </button>
+          <button name="decision" value="deny" type="submit">Cancel</button>
+        </form>
+      </body>
+    </html>`;
+}
diff --git a/src/auth/crypto.ts b/src/auth/crypto.ts
index de57894..e4d93a9 100644
--- a/src/auth/crypto.ts
+++ b/src/auth/crypto.ts
@@ -3,6 +3,15 @@
  * available in Cloudflare Workers.
  */
 
+import { timingSafeEqual } from "node:crypto";
+
+export function secretsEqual(left: string, right: string): boolean {
+  const encoder = new TextEncoder();
+  const a = encoder.encode(left);
+  const b = encoder.encode(right);
+  return a.byteLength === b.byteLength && timingSafeEqual(a, b);
+}
+
 export function generateId(byteLength = 32): string {
   const bytes = new Uint8Array(byteLength);
   crypto.getRandomValues(bytes);
@@ -24,7 +33,7 @@ export async function verifyPkce(
   const data = encoder.encode(codeVerifier);
   const digest = await crypto.subtle.digest("SHA-256", data);
   const computed = base64UrlEncode(new Uint8Array(digest));
-  return computed === codeChallenge;
+  return secretsEqual(computed, codeChallenge);
 }
 
 function base64UrlEncode(bytes: Uint8Array): string {
diff --git a/src/auth/routes.ts b/src/auth/routes.ts
index d25437f..4dce159 100644
--- a/src/auth/routes.ts
+++ b/src/auth/routes.ts
@@ -1,15 +1,13 @@
-/**
- * OAuth 2.1 routes for MCP authorization.
- *
- * Implements the third-party authorization flow: this server acts as an
- * OAuth authorization server to MCP clients while delegating actual user
- * authentication to Are.na's existing OAuth.
- */
-
+/** OAuth authorization for MCP clients, backed by Are.na account sign-in. */
 import { Hono } from "hono";
 import type { Context } from "hono";
-import { OAuthStore } from "./store";
-import { generateId, verifyPkce } from "./crypto";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { z } from "zod";
+import { OAuthStore, type AuthFlowState } from "./store";
+import { generateId, secretsEqual, verifyPkce } from "./crypto";
+import { registrationMetadata, resolveClient } from "./clients";
+import { normalizeScope } from "./scopes";
+import { consentPage } from "./consent";
 
 const ARENA_AUTHORIZE_URL = "https://www.are.na/oauth/authorize";
 const ARENA_TOKEN_URL = "https://api.are.na/v3/oauth/token";
@@ -20,14 +18,54 @@ interface OAuthEnv {
   ARENA_OAUTH_CLIENT_SECRET: string;
 }
 
+type OAuthContext = Context<{ Bindings: OAuthEnv }>;
 export const oauthRoutes = new Hono<{ Bindings: OAuthEnv }>();
 
-function protectedResourceMetadata(c: Context<{ Bindings: OAuthEnv }>) {
-  const origin = new URL(c.req.url).origin;
+function origin(c: OAuthContext): string {
+  return new URL(c.req.url).origin;
+}
+
+// One cookie per flow, so concurrent sign-ins in a browser stay independent.
+function consentCookie(c: OAuthContext, state: string): string {
+  const name = `arena_mcp_consent_${state}`;
+  return new URL(c.req.url).protocol === "https:" ? `__Host-${name}` : name;
+}
+
+function browserMatches(c: OAuthContext, state: string): boolean {
+  const cookie = getCookie(c, consentCookie(c, state));
+  return !!cookie && secretsEqual(cookie, state);
+}
+
+function clientRedirect(
+  c: OAuthContext,
+  flow: AuthFlowState,
+  params: Record<string, string>,
+) {
+  const url = new URL(flow.redirect_uri);
+  for (const [name, value] of Object.entries(params))
+    url.searchParams.set(name, value);
+  url.searchParams.set("iss", origin(c));
+  if (flow.client_state !== undefined)
+    url.searchParams.set("state", flow.client_state);
+  deleteCookie(c, consentCookie(c, flow.arena_state), {
+    path: "/",
+    secure: new URL(c.req.url).protocol === "https:",
+  });
+  return c.redirect(url.toString());
+}
+
+// Auth codes, form tokens, and access tokens must not enter shared caches.
+oauthRoutes.use("*", async (c, next) => {
+  c.header("Cache-Control", "no-store");
+  c.header("Pragma", "no-cache");
+  c.header("Referrer-Policy", "no-referrer");
+  await next();
+});
 
+function protectedResourceMetadata(c: OAuthContext) {
   return c.json({
-    resource: `${origin}/mcp`,
-    authorization_servers: [origin],
+    resource: `${origin(c)}/mcp`,
+    authorization_servers: [origin(c)],
     bearer_methods_supported: ["header"],
     scopes_supported: ["read", "write"],
     resource_name: "Are.na MCP",
@@ -35,9 +73,6 @@ function protectedResourceMetadata(c: Context<{ Bindings: OAuthEnv }>) {
   });
 }
 
-/**
- * RFC 9728 — Protected Resource Metadata
- */
 oauthRoutes.get(
   "/.well-known/oauth-protected-resource",
   protectedResourceMetadata,
@@ -46,91 +81,63 @@ oauthRoutes.get(
   "/.well-known/oauth-protected-resource/mcp",
   protectedResourceMetadata,
 );
-
-/**
- * RFC 8414 — Authorization Server Metadata
- */
-oauthRoutes.get("/.well-known/oauth-authorization-server", (c) => {
-  const origin = new URL(c.req.url).origin;
-
-  return c.json({
-    issuer: origin,
-    authorization_endpoint: `${origin}/authorize`,
-    token_endpoint: `${origin}/token`,
-    registration_endpoint: `${origin}/register`,
+oauthRoutes.get("/.well-known/oauth-authorization-server", (c) =>
+  c.json({
+    issuer: origin(c),
+    authorization_endpoint: `${origin(c)}/authorize`,
+    token_endpoint: `${origin(c)}/token`,
+    registration_endpoint: `${origin(c)}/register`,
     response_types_supported: ["code"],
     grant_types_supported: ["authorization_code"],
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+    client_id_metadata_document_supported: true,
+    authorization_response_iss_parameter_supported: true,
     scopes_supported: ["read", "write"],
-  });
-});
+  }),
+);
 
-/**
- * RFC 7591 — Dynamic Client Registration
- */
 oauthRoutes.post("/register", async (c) => {
-  const body = await c.req.json<{
-    redirect_uris?: string[];
-    client_name?: string;
-  }>();
-
-  if (
-    !body.redirect_uris ||
-    !Array.isArray(body.redirect_uris) ||
-    body.redirect_uris.length === 0
-  ) {
+  const parsed = registrationMetadata.safeParse(
+    await c.req.json().catch(() => null),
+  );
+  if (!parsed.success)
     return c.json(
       {
         error: "invalid_client_metadata",
-        error_description: "redirect_uris is required",
+        error_description:
+          "Provide valid redirect_uris and a supported client authentication method",
       },
       400,
     );
-  }
-
-  const store = new OAuthStore(c.env.OAUTH_KV);
-
-  const client_id = generateId(16);
-  const client_secret = generateId(32);
-
-  await store.putClient({
-    client_id,
-    client_secret,
-    redirect_uris: body.redirect_uris,
-    client_name: body.client_name,
+  const metadata = parsed.data;
+  const client = {
+    client_id: generateId(16),
+    ...(metadata.token_endpoint_auth_method === "client_secret_post"
+      ? { client_secret: generateId(32) }
+      : {}),
+    redirect_uris: metadata.redirect_uris,
+    client_name: metadata.client_name,
+    token_endpoint_auth_method: metadata.token_endpoint_auth_method,
     created_at: Date.now(),
-  });
-
-  return c.json(
-    {
-      client_id,
-      client_secret,
-      redirect_uris: body.redirect_uris,
-      client_name: body.client_name,
-      token_endpoint_auth_method: "client_secret_post",
-    },
-    201,
-  );
+  };
+  await new OAuthStore(c.env.OAUTH_KV).putClient(client);
+  const { created_at, ...registration } = client;
+  return c.json(registration, 201);
 });
 
-/**
- * Authorization endpoint — validates params, stores PKCE state,
- * then redirects the user to Are.na's OAuth consent page.
- */
 oauthRoutes.get("/authorize", async (c) => {
-  const params = c.req.query();
   const {
     client_id,
     redirect_uri,
     response_type,
     code_challenge,
     code_challenge_method,
-    state: clientState,
+    state,
     scope,
-  } = params;
-
-  if (response_type !== "code") {
+    resource,
+  } = c.req.query();
+  if (response_type !== "code")
     return c.json(
       {
         error: "unsupported_response_type",
@@ -138,9 +145,7 @@ oauthRoutes.get("/authorize", async (c) => {
       },
       400,
     );
-  }
-
-  if (!client_id || !redirect_uri || !code_challenge) {
+  if (!client_id || !redirect_uri || !code_challenge)
     return c.json(
       {
         error: "invalid_request",
@@ -149,29 +154,40 @@ oauthRoutes.get("/authorize", async (c) => {
       },
       400,
     );
-  }
-
-  if (code_challenge_method && code_challenge_method !== "S256") {
+  if (
+    code_challenge_method !== "S256" ||
+    !/^[A-Za-z0-9_-]{43}$/.test(code_challenge)
+  )
     return c.json(
       {
         error: "invalid_request",
-        error_description: "Only S256 code_challenge_method is supported",
+        error_description: "A valid S256 code challenge is required",
+      },
+      400,
+    );
+  if (resource !== undefined && resource !== `${origin(c)}/mcp`)
+    return c.json({ error: "invalid_target" }, 400);
+  const requestedScope = normalizeScope(scope);
+  if (requestedScope === null)
+    return c.json(
+      {
+        error: "invalid_scope",
+        error_description: "Supported scopes are read and write",
       },
       400,
     );
-  }
 
   const store = new OAuthStore(c.env.OAUTH_KV);
-  const client = await store.getClient(client_id);
-
-  if (!client) {
+  const client = await resolveClient(client_id, store);
+  if (!client)
     return c.json(
-      { error: "invalid_client", error_description: "Unknown client_id" },
+      {
+        error: "invalid_client",
+        error_description: "Unknown or unsupported client identity",
+      },
       401,
     );
-  }
-
-  if (!client.redirect_uris.includes(redirect_uri)) {
+  if (!client.redirect_uris.includes(redirect_uri))
     return c.json(
       {
         error: "invalid_request",
@@ -179,130 +195,155 @@ oauthRoutes.get("/authorize", async (c) => {
       },
       400,
     );
-  }
-
-  // Generate a state token that ties this flow together.
-  // We encode the MCP client's state inside so we can return it on callback.
-  const arenaState = generateId(16);
 
-  await store.putAuthFlow(arenaState, {
+  const arenaState = generateId(32);
+  await store.putConsent(arenaState, {
     client_id,
     redirect_uri,
     code_challenge,
-    code_challenge_method: code_challenge_method ?? "S256",
-    scope,
+    code_challenge_method,
+    scope: requestedScope,
     arena_state: arenaState,
+    client_state: state,
   });
+  setCookie(c, consentCookie(c, arenaState), arenaState, {
+    path: "/",
+    httpOnly: true,
+    secure: new URL(c.req.url).protocol === "https:",
+    sameSite: "Lax",
+    maxAge: 600,
+  });
+  c.header(
+    "Content-Security-Policy",
+    "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'",
+  );
+  c.header("X-Frame-Options", "DENY");
+  // Under no-referrer, browsers send `Origin: null` with the consent form.
+  c.header("Referrer-Policy", "same-origin");
+  return c.html(consentPage(client, arenaState, redirect_uri, requestedScope));
+});
 
-  // Also store the MCP client's original `state` so we can forward it back
-  if (clientState) {
-    await c.env.OAUTH_KV.put(`client_state:${arenaState}`, clientState, {
-      expirationTtl: 600,
-    });
+oauthRoutes.post("/authorize/consent", async (c) => {
+  const body = await c.req.parseBody();
+  const state = body.state;
+  if (
+    typeof state !== "string" ||
+    !browserMatches(c, state) ||
+    c.req.header("Origin") !== origin(c)
+  )
+    return c.json(
+      {
+        error: "invalid_request",
+        error_description: "Invalid consent request; restart sign-in",
+      },
+      400,
+    );
+  if (body.decision !== "allow" && body.decision !== "deny")
+    return c.json({ error: "invalid_request" }, 400);
+  const store = new OAuthStore(c.env.OAUTH_KV);
+  const flow = await store.getConsent(state);
+  if (!flow)
+    return c.json(
+      {
+        error: "invalid_request",
+        error_description: "Expired or already submitted consent",
+      },
+      400,
+    );
+  if (body.decision === "deny") {
+    await store.deleteConsent(state);
+    return clientRedirect(c, flow, { error: "access_denied" });
   }
-
-  const origin = new URL(c.req.url).origin;
-  const arenaScope = scope === "read" ? "read" : "write";
-
-  const arenaParams = new URLSearchParams({
+  await store.putAuthFlow(state, flow);
+  await store.deleteConsent(state);
+  const params = new URLSearchParams({
     client_id: c.env.ARENA_OAUTH_CLIENT_ID,
-    redirect_uri: `${origin}/callback`,
+    redirect_uri: `${origin(c)}/callback`,
     response_type: "code",
-    state: arenaState,
-    scope: arenaScope,
+    state,
+    scope: flow.scope,
   });
+  return c.redirect(`${ARENA_AUTHORIZE_URL}?${params}`);
+});
 
-  return c.redirect(`${ARENA_AUTHORIZE_URL}?${arenaParams.toString()}`);
+const upstreamToken = z.object({
+  access_token: z.string().min(1),
+  scope: z.string().optional(),
 });
 
-/**
- * OAuth callback from Are.na — exchanges the Are.na auth code for an
- * access token, generates an MCP auth code, and redirects back to the
- * MCP client's redirect_uri.
- */
 oauthRoutes.get("/callback", async (c) => {
-  const { code: arenaCode, state: arenaState, error } = c.req.query();
-
+  const { code, state, error } = c.req.query();
+  if (!state || !browserMatches(c, state))
+    return c.text("Invalid authorization state; restart sign-in", 400);
+  const store = new OAuthStore(c.env.OAUTH_KV);
+  const flow = await store.getAuthFlow(state);
+  if (!flow)
+    return c.text(
+      "Invalid or expired authorization state; restart sign-in",
+      400,
+    );
   if (error) {
-    return c.text(`Authorization denied: ${error}`, 400);
-  }
-
-  if (!arenaCode || !arenaState) {
-    return c.text("Missing code or state parameter", 400);
+    await store.deleteAuthFlow(state);
+    return clientRedirect(c, flow, { error: "access_denied" });
   }
-
-  const store = new OAuthStore(c.env.OAUTH_KV);
-  const flow = await store.getAuthFlow(arenaState);
-
-  if (!flow) {
-    return c.text("Invalid or expired authorization state", 400);
+  if (!code) return c.text("Missing authorization code", 400);
+
+  let token;
+  try {
+    const response = await fetch(ARENA_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        client_id: c.env.ARENA_OAUTH_CLIENT_ID,
+        client_secret: c.env.ARENA_OAUTH_CLIENT_SECRET,
+        code,
+        redirect_uri: `${origin(c)}/callback`,
+      }),
+      signal: AbortSignal.timeout(10000),
+    });
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new Error("Upstream token exchange failed");
+    }
+    token = upstreamToken.parse(await response.json());
+  } catch {
+    await store.deleteAuthFlow(state);
+    return clientRedirect(c, flow, {
+      error: "server_error",
+      error_description: "Could not complete Are.na sign-in; please try again",
+    });
   }
-
-  // Exchange the Are.na auth code for an access token
-  const origin = new URL(c.req.url).origin;
-
-  const tokenRes = await fetch(ARENA_TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      grant_type: "authorization_code",
-      client_id: c.env.ARENA_OAUTH_CLIENT_ID,
-      client_secret: c.env.ARENA_OAUTH_CLIENT_SECRET,
-      code: arenaCode,
-      redirect_uri: `${origin}/callback`,
-    }),
-  });
-
-  if (!tokenRes.ok) {
-    const body = await tokenRes.text();
-    return c.text(`Failed to exchange code with Are.na: ${body}`, 502);
+  const grantedScope =
+    token.scope === undefined ? flow.scope : normalizeScope(token.scope);
+  if (
+    !grantedScope ||
+    grantedScope
+      .split(" ")
+      .some((scope) => !flow.scope.split(" ").includes(scope))
+  ) {
+    await store.deleteAuthFlow(state);
+    return clientRedirect(c, flow, {
+      error: "server_error",
+      error_description: "Are.na returned an unexpected scope",
+    });
   }
-
-  const tokenData = (await tokenRes.json()) as { access_token: string };
-
-  // Generate an MCP authorization code mapped to the Are.na token
   const mcpCode = generateId(32);
-
   await store.putAuthCode(mcpCode, {
-    arena_access_token: tokenData.access_token,
+    arena_access_token: token.access_token,
     client_id: flow.client_id,
     redirect_uri: flow.redirect_uri,
     code_challenge: flow.code_challenge,
     code_challenge_method: flow.code_challenge_method,
-    scope: flow.scope,
+    scope: grantedScope,
   });
-
-  // Clean up the flow state
-  await store.deleteAuthFlow(arenaState);
-
-  // Redirect back to the MCP client with the code
-  const clientState = await c.env.OAUTH_KV.get(`client_state:${arenaState}`);
-  if (clientState) {
-    await c.env.OAUTH_KV.delete(`client_state:${arenaState}`);
-  }
-
-  const redirectUrl = new URL(flow.redirect_uri);
-  redirectUrl.searchParams.set("code", mcpCode);
-  if (clientState) {
-    redirectUrl.searchParams.set("state", clientState);
-  }
-
-  return c.redirect(redirectUrl.toString());
+  await store.deleteAuthFlow(state);
+  return clientRedirect(c, flow, { code: mcpCode });
 });
 
-/**
- * Token endpoint — validates the MCP auth code + PKCE code_verifier,
- * then returns the Are.na access token as the MCP access token.
- */
 oauthRoutes.post("/token", async (c) => {
   const body = await c.req.parseBody();
-
-  const grant_type = body["grant_type"] as string;
-  const code = body["code"] as string;
-  const code_verifier = body["code_verifier"] as string;
-  const redirect_uri = body["redirect_uri"] as string;
-
-  if (grant_type !== "authorization_code") {
+  if (body.grant_type !== "authorization_code")
     return c.json(
       {
         error: "unsupported_grant_type",
@@ -310,59 +351,88 @@ oauthRoutes.post("/token", async (c) => {
       },
       400,
     );
-  }
-
-  if (!code || !code_verifier) {
+  const {
+    code,
+    code_verifier,
+    client_id,
+    redirect_uri,
+    client_secret,
+    resource,
+  } = body;
+  if (
+    typeof code !== "string" ||
+    !code ||
+    typeof code_verifier !== "string" ||
+    !/^[A-Za-z0-9._~-]{43,128}$/.test(code_verifier) ||
+    typeof client_id !== "string" ||
+    !client_id ||
+    (redirect_uri !== undefined &&
+      (typeof redirect_uri !== "string" || !redirect_uri))
+  )
     return c.json(
       {
         error: "invalid_request",
-        error_description: "code and code_verifier are required",
+        error_description:
+          "code, a valid code_verifier, and client_id are required",
       },
       400,
     );
-  }
-
+  if (resource !== undefined && resource !== `${origin(c)}/mcp`)
+    return c.json({ error: "invalid_target" }, 400);
+  // Only the advertised methods are accepted; never ignore an attempted Basic
+  // or JWT authentication and accidentally treat it as a public-client request.
+  if (
+    c.req.header("Authorization") ||
+    body.client_assertion !== undefined ||
+    body.client_assertion_type !== undefined
+  )
+    return c.json({ error: "invalid_client" }, 401);
   const store = new OAuthStore(c.env.OAUTH_KV);
-  const entry = await store.getAuthCode(code);
-
-  if (!entry) {
-    return c.json(
-      {
-        error: "invalid_grant",
-        error_description: "Invalid or expired authorization code",
-      },
-      400,
-    );
+  const client = await resolveClient(client_id, store);
+  if (!client) return c.json({ error: "invalid_client" }, 401);
+  // Existing DCR records predate this field, but were issued a client secret.
+  const method =
+    client.token_endpoint_auth_method ??
+    (client.client_secret ? "client_secret_post" : "none");
+  if (method === "client_secret_post") {
+    if (
+      typeof client_secret !== "string" ||
+      !client.client_secret ||
+      !secretsEqual(client_secret, client.client_secret)
+    )
+      return c.json({ error: "invalid_client" }, 401);
+  } else if (client_secret !== undefined) {
+    return c.json({ error: "invalid_client" }, 401);
   }
 
-  if (redirect_uri && redirect_uri !== entry.redirect_uri) {
-    return c.json(
-      { error: "invalid_grant", error_description: "redirect_uri mismatch" },
-      400,
-    );
-  }
-
-  const valid = await verifyPkce(
-    code_verifier,
-    entry.code_challenge,
-    entry.code_challenge_method,
-  );
-
-  if (!valid) {
+  // OAuth 2.1 clients may omit redirect_uri at token exchange. When supplied
+  // by an OAuth 2.0 client, it must match the authorization request exactly.
+  const entry = await store.getAuthCode(code);
+  if (
+    !entry ||
+    entry.client_id !== client_id ||
+    (redirect_uri !== undefined && entry.redirect_uri !== redirect_uri) ||
+    !client.redirect_uris.includes(entry.redirect_uri)
+  )
+    return c.json({ error: "invalid_grant" }, 400);
+  if (
+    !(await verifyPkce(
+      code_verifier,
+      entry.code_challenge,
+      entry.code_challenge_method,
+    ))
+  )
     return c.json(
       { error: "invalid_grant", error_description: "PKCE verification failed" },
       400,
     );
-  }
-
-  // Consume the authorization code (single use)
+  // KV deletion prevents sequential replay. It is not an atomic redemption
+  // primitive across concurrent requests; that requires a coordinated store.
   await store.deleteAuthCode(code);
-
-  // Return the Are.na access token directly.
-  // Are.na tokens don't expire, so we omit expires_in and refresh_token.
   return c.json({
     access_token: entry.arena_access_token,
     token_type: "Bearer",
-    scope: entry.scope ?? "read",
+    // Codes stored without a scope were issued for write access.
+    scope: entry.scope ?? "write",
   });
 });
diff --git a/src/auth/scopes.ts b/src/auth/scopes.ts
new file mode 100644
index 0000000..cb87c59
--- /dev/null
+++ b/src/auth/scopes.ts
@@ -0,0 +1,11 @@
+/** Validate and canonicalize the scopes understood by the Are.na API. */
+export function normalizeScope(scope: string | undefined): string | null {
+  if (scope === undefined) return "write";
+  const scopes = scope.split(" ").filter(Boolean);
+  if (
+    !scopes.length ||
+    scopes.some((value) => value !== "read" && value !== "write")
+  )
+    return null;
+  return ["read", "write"].filter((value) => scopes.includes(value)).join(" ");
+}
diff --git a/src/auth/store.ts b/src/auth/store.ts
index c69c3f1..b811822 100644
--- a/src/auth/store.ts
+++ b/src/auth/store.ts
@@ -6,6 +6,7 @@
 export interface OAuthClient {
   client_id: string;
   client_secret?: string;
+  token_endpoint_auth_method?: "none" | "client_secret_post";
   redirect_uris: string[];
   client_name?: string;
   created_at: number;
@@ -16,8 +17,9 @@ export interface AuthFlowState {
   redirect_uri: string;
   code_challenge: string;
   code_challenge_method: string;
-  scope?: string;
+  scope: string;
   arena_state: string;
+  client_state?: string;
 }
 
 export interface AuthCodeEntry {
@@ -53,6 +55,44 @@ export class OAuthStore {
     return raw ? (JSON.parse(raw) as OAuthClient) : null;
   }
 
+  async putClientMetadata(client: OAuthClient, ttl: number): Promise<void> {
+    await this.kv.put(
+      key("cimd", client.client_id),
+      JSON.stringify({
+        client,
+        expires_at: Date.now() + ttl * 1000,
+      }),
+      { expirationTtl: ttl },
+    );
+  }
+
+  async getClientMetadata(clientId: string): Promise<OAuthClient | null> {
+    const raw = await this.kv.get(key("cimd", clientId));
+    if (!raw) return null;
+    const cached = JSON.parse(raw) as {
+      client: OAuthClient;
+      expires_at: number;
+    };
+    return cached.expires_at > Date.now() ? cached.client : null;
+  }
+
+  // Pending consent and approved flows use different keys, avoiding repeated
+  // writes to the same KV key when the user immediately submits the form.
+  async putConsent(state: string, flow: AuthFlowState): Promise<void> {
+    await this.kv.put(key("consent", state), JSON.stringify(flow), {
+      expirationTtl: TTL.AUTH_FLOW,
+    });
+  }
+
+  async getConsent(state: string): Promise<AuthFlowState | null> {
+    const raw = await this.kv.get(key("consent", state));
+    return raw ? (JSON.parse(raw) as AuthFlowState) : null;
+  }
+
+  async deleteConsent(state: string): Promise<void> {
+    await this.kv.delete(key("consent", state));
+  }
+
   async putAuthFlow(state: string, flow: AuthFlowState): Promise<void> {
     await this.kv.put(key("flow", state), JSON.stringify(flow), {
       expirationTtl: TTL.AUTH_FLOW,