Descope example: token verification fails with "unexpected iss claim value" (skybridge v1.2.7)

[claude]

Summary

On the Descope skybridge example (skybridge v1.2.7, which includes the two prior descope provider fixes #942 and #950), the server now starts, but MCP requests fail token verification:

Server process failed to start:
Streamable HTTP error: Error POSTing to endpoint:
{
  "error": "invalid_token",
  "error_description": "Token verification failed: unexpected \"iss\" claim value"
}

Context / what's already fixed

• fix(descope): follow discovery issuer for base-project-issuer MCP servers #942 (merged): descopeProvider builds the validation issuer as the base project https://api.descope.com/v1/apps/<projectId> so startup discovery (RFC 8414 self-reference check) passes.
• fix(descope): advertise agentic AS in protected-resource metadata #950 (merged): the protected-resource metadata now advertises the agentic AS (.../apps/agentic/<projectId>/<mcpServerId>) as authorization_servers, while token validation keeps verify.issuer = the base project.

This bug (next layer)

Token verification (verify.issuer, currently the base-project URL) rejects the access token's iss claim. So the iss claim in the JWT Descope actually issues does not equal the base-project issuer skybridge validates against. Likely the token's iss is the agentic AS URL (.../apps/agentic/<projectId>/<mcpServerId>) — which would be inconsistent with the agentic discovery document declaring the base project as its issuer (the very reason #942 set validation to the base project). Descope appears internally inconsistent between its discovery-document issuer and the token iss.

Next step to pin it down

Decode an actual Descope-issued access token (JWT) from a failing run and read its iss claim, then compare with:

• the agentic discovery doc's issuer (observed: base project .../apps/<projectId>),
• skybridge's verify.issuer (currently base project).

Depending on what the token's iss really is, the fix is either to set verify.issuer to the value Descope actually stamps in iss, or to accept both the base-project and agentic issuer forms during verification. Requires the JWT to decide.

Impact / urgency

The playground OAuth e2e still runs against the Auth0 example for now (Auth0 DCR client space was cleared; good for roughly the next ~50 e2e deployments before the "too many entities" limit recurs). The Descope migration is blocked on this. Follows #941/#942/#949/#950.