dynamic-registration-means-no-allowlist
decisionClients register themselves (RFC 7591). You do not add Claude or OpenAI to anything — one setting covers every client that will ever connect, including ones that do not exist yet.
Rejected the alternative of pre-registering each client by hand: it does not scale to a public directory listing, and the moment a new client appears you are back in a dashboard.
The cost, stated honestly: anyone can register a client and choose the name it displays. So your consent screen is the only thing standing between a user and an app that borrowed a familiar name. Show the redirect URI there — it is the one field an impostor cannot fake — and do not let the app's self-declared name be the only prominent thing on the page.