OidcTokenExchanger fetched the discovery document from the issuerUri as-is, but the database stores the issuer URI (e.g. /oidc), not the full discovery URL. Logto returns 404 for the bare issuer path. SecurityConfig already appended the well-known suffix — now the token exchanger does the same. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>