···385385 config := oauthApp.GetConfig()
386386 metadata := config.ClientMetadata()
387387388388+ // For confidential clients, ensure JWKS is included
389389+ // The indigo library should populate this automatically, but we explicitly set it here
390390+ // to be defensive and ensure it's always present for confidential clients
391391+ if config.IsConfidential() && metadata.JWKS == nil {
392392+ jwks := config.PublicJWKS()
393393+ metadata.JWKS = &jwks
394394+ }
395395+388396 // Convert indigo's metadata to map so we can add custom fields
389397 metadataBytes, err := json.Marshal(metadata)
390398 if err != nil {