Align SDK integration guidance with provider redirect URI hardening: use HTTPS callback URLs in production and limit HTTP callbacks to localhost loopback during development/testing.
Update integration guidance so consuming apps treat access_denied as an expected provider authorization result when membership or privilege state changes during the OAuth consent flow.
Document that integrations should expect provider-side abuse controls on OAuth control endpoints and handle 429 responses with retry/backoff semantics.
Clarify that providers may return access_denied at callback time even after consent UI is shown, when membership/tenant scope changes before consent submission. This aligns integration guidance with current provider-side security enforcement.
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
Andy Dixon