Token exchange fails with "unauthorized_client" for specific scopes

[minaattr]

Problem
Scope registrations succeed but subsequent token exchanges fail with unauthorized_client. The issue appears to be that jwtlet is using the "memory" storage backend by default, which:

1. Does not persist scope mappings across restarts
2. May have issues with concurrent access patterns

Evidence
From jwtlet README.md configuration reference:

#Storage backend: "memory" (default) or "postgres"
[storage_backend]
type = "memory"  # ← Default

What We Observed

1. POST /api/v1/scopes returns successfully
2. POST /api/v1/mappings returns successfully
3. POST /token (token exchange) immediately returns {"error":"unauthorized_client"}
4. Same error occurs even after scope registration completes

Hypothesis

• Scope mappings registered in memory storage are not being found during token exchange
• Possible race condition or storage lookup issue in memory backend
• PostgreSQL backend should be used for production

Recommendation
JAD deployment should configure jwtlet with PostgreSQL backend, not memory storage:

[storage_backend]
type = "postgres"
url = "postgresql://user:pass@postgres:5432/jwtlet"

Steps to Reproduce (in JAD deployment)

1. Register scope via management API
2. Immediately attempt token exchange with that scope
3. Observe unauthorized_client error despite successful registration

Environment

• JAD dataspace (eclipse-dataspace-hub/jad)
• Core Platform Distribution Helm chart
• jwtlet deployed with memory storage (default)