A validated introspection, JWKS, or dual-mode OAuth configuration.
Remarks
At least one verification mechanism is required: an introspection endpoint or
a JWKS URI. Issuer, authorization endpoint, token endpoint, resource URL, and
public URL must be HTTPS unless the explicit localhost-only insecure override
is enabled for development.
Throws
Error when required values are missing, unsafe, or internally
inconsistent.
Load and validate OAuth resource-server configuration from environment variables.