so after resorting to good old network capture I figured out whatâs wrong
our oAuth configuration was wrong
it was never meant to work honestly and because older Cursor versions auto-magically got around I was under impression that our setup is correct
e.g. this should probably never work 
and possibly even empty array
authorization_servers: [null],
Can you please add response validation for /.well-known/oauth-protected-resource response?
also please log response (at least in debug mode) and which auth URL will be tried to expedite debugging
we would have caught issue much earlier if Cursor wouldnât try to be so nice 