---
'@pdsjs/core': patch
---

A loopback client's redirect URI matches on any port, as RFC 8252 requires.
A native app registers `http://127.0.0.1/callback` and listens on whatever
port it is given, and every such login was refused with `invalid_request`.
The refusal now carries its reason in `error_description`.