An agent endpoint that speaks OAuth publishes a resource identifier — the address a client binds its token to. It is usually derived from a configured base URL, which means moving the hostname without moving that value leaves you serving metadata that names the OLD host.

What that looks like: everything passes. The endpoint answers. The metadata document loads. Health checks are green. A client registers, authorizes, gets a code, exchanges it — and then the token is rejected at the final call, because the audience it was minted for is not the address it is being used against.

What catches it: fetch the 401 challenge and the metadata document in two separate calls and compare them to each other. Each one alone looks perfect. Only the comparison can tell you they disagree.

We had already been bitten by the same SHAPE once before, on a signing-algorithm change: registration, consent and code exchange all succeeded and the token was still refused at the last hop. When every step of a handshake passes except the last, suspect an identifier, not a step.