Have not persued this yet, but RFC 7523 has been revised and this may require changes: https://datatracker.ietf.org/doc/draft-ietf-oauth-rfc7523bis/