diff --git a/example/flask_op/config.json b/example/flask_op/config.json
index 3b75e18f..2fe378fc 100644
--- a/example/flask_op/config.json
+++ b/example/flask_op/config.json
@@ -208,13 +208,8 @@
             "request_uri_parameter_supported": true,
             "response_types_supported": [
               "code",
-              "token",
               "id_token",
-              "code token",
-              "code id_token",
-              "id_token token",
-              "code id_token token",
-              "none"
+              "code id_token"
             ],
             "response_modes_supported": [
               "query",
diff --git a/example/flask_op/private/cookie_jwks.json b/example/flask_op/private/cookie_jwks.json
index 3aafdf12..528741ff 100644
--- a/example/flask_op/private/cookie_jwks.json
+++ b/example/flask_op/private/cookie_jwks.json
@@ -1 +1 @@
-{"keys": [{"kty": "oct", "use": "enc", "kid": "enc", "k": "gVdGvOn9TFG38gzqs2uO-pQB40qxJbfm"}, {"kty": "oct", "use": "sig", "kid": "sig", "k": "HlW_dFC6aquKPZ6zGtq2dZEBcntP9uHd"}]}
\ No newline at end of file
+{"keys": [{"kty": "oct", "use": "enc", "kid": "enc", "k": "GCizp3ewVRV0VZEef3VQwFve7n2QwAFI"}, {"kty": "oct", "use": "sig", "kid": "sig", "k": "QC2JxpVJXPDMpYv_h76jIrt_lA1P4KSu"}]}
\ No newline at end of file
diff --git a/example/flask_rp/application.py b/example/flask_rp/application.py
index cf58d426..cac411f1 100644
--- a/example/flask_rp/application.py
+++ b/example/flask_rp/application.py
@@ -16,7 +16,7 @@ def init_oidc_rp_handler(app):
     if _rp_conf.key_conf:
         _kj = init_key_jar(**_rp_conf.key_conf)
         _path = _rp_conf.key_conf['public_path']
-        # removes ./ and / from the begin of the string
+        # removes ./ and / from the begining of the string
         _path = re.sub('^(.)/', '', _path)
     else:
         _kj = KeyJar()
diff --git a/example/flask_rp/config.json b/example/flask_rp/config.json
index ba980896..8ffdff51 100644
--- a/example/flask_rp/config.json
+++ b/example/flask_rp/config.json
@@ -87,26 +87,26 @@
   },
   "clients": {
     "": {
-      "client_preferences": {
+      "httpc_params": {
+        "verify": false
+      },
+      "client_type": "oidc",
+      "capabilities": {
         "application_name": "rphandler",
-        "metadata": {
-          "application_type": "web",
-          "contacts": [
-            "ops@example.com"
-          ],
-          "response_types": [
-            "code"
-          ]
-        },
-        "usage": {
-          "scope": [
-            "openid",
-            "profile",
-            "email",
-            "address",
-            "phone"
-          ]
-        },
+        "application_type": "web",
+        "contacts": [
+          "ops@example.com"
+        ],
+        "response_types_supported": [
+          "code"
+        ],
+        "scopes_supported": [
+          "openid",
+          "profile",
+          "email",
+          "address",
+          "phone"
+        ],
         "token_endpoint_auth_methods": [
           "client_secret_basic",
           "client_secret_post"
diff --git a/example/flask_rp/templates/opbyuid.html b/example/flask_rp/templates/opbyuid.html
index a91b6b98..5e19c7b1 100644
--- a/example/flask_rp/templates/opbyuid.html
+++ b/example/flask_rp/templates/opbyuid.html
@@ -19,7 +19,7 @@ <h3>By entering your unique identifier:</h3>
   <input type="text" id="uid" name="uid" class="form-control" placeholder="UID" autofocus>
     <h3>an issuer ID</h3>
     <input type="text" id="dyn_iss" name="dyn_iss" class="form-control">
-  <h3><em>Or</em> you can chose one of the preconfigured OpenID Connect Providers</h3>
+  <h3><em>Or</em> you can choose one of the preconfigured OpenID Connect Providers</h3>
   <select name="static_iss">
   <option value=""></option>
       {% for op in providers %}
diff --git a/example/flask_rp/views.py b/example/flask_rp/views.py
index d833a2d2..e74665d0 100644
--- a/example/flask_rp/views.py
+++ b/example/flask_rp/views.py
@@ -67,7 +67,7 @@ def rp():
         except Exception as err:
             return make_response('Something went wrong:{}'.format(err), 400)
         else:
-            response = redirect(result['url'], 303)
+            response = redirect(result, 303)
             return response
     else:
         _providers = current_app.rp_config.clients.keys()
@@ -106,7 +106,7 @@ def finalize(op_identifier, request_args):
     session['state'] = request_args.get('state')
 
     if session['state']:
-        iss = _context.state.get_iss(session['state'])
+        iss = _context.cstate.get_set(session['state'], claim=["iss"])['iss']
     else:
         return make_response('Unknown state', 400)
 
@@ -158,14 +158,9 @@ def get_op_identifier_by_cb_uri(url: str):
     uri = splitquery(url)[0]
     for k, v in current_app.rph.issuer2rp.items():
         for endpoint in v.get_callback_uris():
-            _endps = v.get_metadata_value(endpoint)
-            if _endps is None:
-                continue
-            elif isinstance(_endps,str):
-                if _endps == uri:
+            for val in v.context.claims.get_preference(endpoint):
+                if val == uri:
                     return k
-            elif uri in _endps:
-                return k
     return None
 
 @oidc_rp_views.route('/authz_cb/<op_identifier>')
diff --git a/pyproject.toml b/pyproject.toml
index a155aa8d..8f06b36a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,13 +7,13 @@ build-backend = "setuptools.build_meta"
 
 [metadata]
 name = "idpyoidc"
-version = "2.1.0"
+version = "3.0.0"
 author = "Roland Hedberg"
 author_email = "roland@catalogix.se"
 description = "Everything OAuth2 and OIDC"
 long_description = "file: README.md"
 long_description_content_type = "text/markdown"
-url = "https://github.com/IdentityPython/oidc-op"
+url = "https://github.com/IdentityPython/idpy-oidc"
 license = "Apache-2.0"
 classifiers =[
     "Programming Language :: Python :: 3",
@@ -31,7 +31,7 @@ line-length = 100
 
 [tool.isort]
 force_single_line = true
-known_first_party = "oidcop"
+known_first_party = "idpyoidc"
 include_trailing_comma = true
 force_grid_wrap = 0
 use_parentheses = true
diff --git a/setup.py b/setup.py
index 3c2be62a..9c15c688 100644
--- a/setup.py
+++ b/setup.py
@@ -70,7 +70,7 @@ def run_tests(self):
         "Programming Language :: Python :: 3.11",
         "Topic :: Software Development :: Libraries :: Python Modules"],
     install_requires=[
-        "cryptojwt>=1.8.1",
+        "cryptojwt>=1.8.3",
         "pyOpenSSL",
         "filelock>=3.0.12",
         'pyyaml>=5.1.2',
diff --git a/src/idpyoidc/__init__.py b/src/idpyoidc/__init__.py
index 51dca059..c7e69bd5 100644
--- a/src/idpyoidc/__init__.py
+++ b/src/idpyoidc/__init__.py
@@ -1,5 +1,5 @@
 __author__ = "Roland Hedberg"
-__version__ = "2.2.0"
+__version__ = "3.0.0"
 
 VERIFIED_CLAIM_PREFIX = "__verified"
 
diff --git a/src/idpyoidc/claims.py b/src/idpyoidc/claims.py
index 7a474acf..f8f2d2b1 100644
--- a/src/idpyoidc/claims.py
+++ b/src/idpyoidc/claims.py
@@ -132,7 +132,7 @@ def add_extra_keys(self, keyjar, id):
         return None
 
     def get_jwks(self, keyjar):
-        return None
+        return keyjar.export_jwks()
 
     def handle_keys(self, configuration: dict, keyjar: Optional[KeyJar] = None):
         _jwks = _jwks_uri = None
diff --git a/src/idpyoidc/client/client_auth.py b/src/idpyoidc/client/client_auth.py
index fbf422a1..3624f324 100755
--- a/src/idpyoidc/client/client_auth.py
+++ b/src/idpyoidc/client/client_auth.py
@@ -12,15 +12,15 @@
 
 from idpyoidc.defaults import DEF_SIGN_ALG
 from idpyoidc.defaults import JWT_BEARER
-from idpyoidc.message.oauth2 import SINGLE_OPTIONAL_STRING
+from idpyoidc.message import Message
 from idpyoidc.message.oauth2 import AccessTokenRequest
+from idpyoidc.message.oauth2 import SINGLE_OPTIONAL_STRING
 from idpyoidc.message.oidc import AuthnToken
 from idpyoidc.time_util import utc_time_sans_frac
 from idpyoidc.util import rndstr
-
+from .util import sanitize
 from ..message import VREQUIRED
 from ..util import instantiate
-from .util import sanitize
 
 # from idpyoidc.oidc.backchannel_authentication import ClientNotificationAuthn
 
@@ -29,6 +29,7 @@
 
 __author__ = "roland hedberg"
 
+DEFAULT_ACCESS_TOKEN_TYPE = "Bearer"
 
 class AuthnFailure(Exception):
     """Unspecified Authentication failure"""
@@ -137,8 +138,8 @@ def _with_or_without_client_id(request, service):
         :param service: A :py:class:`idpyoidc.client.service.Service` instance
         """
         if (
-            isinstance(request, AccessTokenRequest)
-            and request["grant_type"] == "authorization_code"
+                isinstance(request, AccessTokenRequest)
+                and request["grant_type"] == "authorization_code"
         ):
             if "client_id" not in request:
                 try:
@@ -228,7 +229,7 @@ def modify_request(self, request, service, **kwargs):
                 if not request["client_secret"]:
                     raise AuthnFailure("Missing client secret")
 
-        # Set the client_id in the the request
+        # Set the client_id in the request
         request["client_id"] = _context.get_client_id()
 
     def construct(self, request, service=None, http_args=None, **kwargs):
@@ -276,10 +277,42 @@ def find_token(request, token_type, service, **kwargs):
     except KeyError:
         # Get the latest acquired token.
         _state = kwargs.get("state", kwargs.get("key"))
-        _arg = service.upstream_get("context").cstate.get_set(_state, claim=[token_type])
+        _arg = service.upstream_get("context").cstate.get_set(_state, claim=[token_type,
+                                                                             "token_type"])
         return _arg.get("access_token")
 
 
+def find_token_info(request: Union[Message, dict], token_type: str, service, **kwargs) -> dict:
+    """
+    Token acquired by a previous run service.
+
+    :param token_type:
+    :param kwargs:
+    :return:
+    """
+
+    if request is not None:
+        _token = request.get(token_type, None)
+        if _token:
+            del request[token_type]
+            # Required under certain circumstances :-) not under other
+            request.c_param[token_type] = SINGLE_OPTIONAL_STRING
+            return {token_type: _token, "token_type": DEFAULT_ACCESS_TOKEN_TYPE}
+
+    _state = kwargs.get("state", kwargs.get("key"))
+    if _state:
+        _token_info = service.upstream_get("context").cstate.get_set(
+            _state, claim=[token_type, "token_type"])
+    else:
+        _token_info = {"token_type": DEFAULT_ACCESS_TOKEN_TYPE}
+
+    _token = kwargs.get("access_token", None)
+    if _token:
+        return {token_type: _token, "token_type": _token_info["token_type"]}
+    else:
+        return _token_info
+
+
 class BearerHeader(ClientAuthnMethod):
     """The bearer header authentication method."""
 
@@ -296,18 +329,20 @@ def construct(self, request=None, service=None, http_args=None, **kwargs):
         """
 
         if service.service_name == "refresh_token":
-            _acc_token = find_token(request, "refresh_token", service, **kwargs)
+            _token_type = "refresh_token"
         elif service.service_name == "token_exchange":
-            _acc_token = find_token(request, "subject_token", service, **kwargs)
+            _token_type = "subject_token"
         else:
-            _acc_token = find_token(request, "access_token", service, **kwargs)
+            _token_type = "access_token"
 
-        if not _acc_token:
+        _token_info = find_token_info(request, _token_type, service, **kwargs)
+
+        if not _token_info:
             raise KeyError("No bearer token available")
 
-        # The authorization value starts with 'Bearer' when bearer tokens
-        # are used
-        _bearer = "Bearer {}".format(_acc_token)
+        # The authorization value starts with the token_type
+        # if _token_info["token_type"].to_lower() != "bearer":
+        _bearer = f"{_token_info['token_type']} {_token_info[_token_type]}"
 
         # Add 'Authorization' to the headers
         if http_args is None:
@@ -502,9 +537,11 @@ def _construct_client_assertion(self, service, **kwargs):
         except KeyError:
             _args = {}
 
+        _client_id = kwargs.get("client_id", _entity.client_id)
+
         # construct the signed JWT with the assertions and add
         # it as value to the 'client_assertion' claim of the request
-        return assertion_jwt(_entity.client_id, signing_key, audience, algorithm, **_args)
+        return assertion_jwt(_client_id, signing_key, audience, algorithm, **_args)
 
     def modify_request(self, request, service, **kwargs):
         """
@@ -643,6 +680,8 @@ def single_authn_setup(name, spec):
     else:
         if spec is None:
             cls = get_client_authn_class(name)
+            if cls is None:
+                cls = importer(name)
         elif isinstance(spec, str):
             cls = importer(spec)
         else:
diff --git a/src/idpyoidc/client/current.py b/src/idpyoidc/client/current.py
index 435ea9ea..f91514a9 100644
--- a/src/idpyoidc/client/current.py
+++ b/src/idpyoidc/client/current.py
@@ -105,3 +105,6 @@ def create_state(self, **kwargs):
         _key = self.create_key()
         self._db[_key] = kwargs
         return _key
+
+    def keys(self):
+        return self._db.keys()
\ No newline at end of file
diff --git a/src/idpyoidc/client/entity.py b/src/idpyoidc/client/entity.py
index 61ca959f..2ada9ebe 100644
--- a/src/idpyoidc/client/entity.py
+++ b/src/idpyoidc/client/entity.py
@@ -216,4 +216,4 @@ def import_keys(self, keyspec):
         return _keyjar
 
     def get_callback_uris(self):
-        return self.context.claims.callback_uri
+        return self.context.claims.get_preference("callback_uris")
diff --git a/src/idpyoidc/client/oauth2/__init__.py b/src/idpyoidc/client/oauth2/__init__.py
index 9911697e..620608b0 100755
--- a/src/idpyoidc/client/oauth2/__init__.py
+++ b/src/idpyoidc/client/oauth2/__init__.py
@@ -160,6 +160,10 @@ def get_response(
         :param kwargs:
         :return:
         """
+        _data = kwargs.get("data")
+        if _data and not body:
+            body = _data
+
         try:
             resp = self.httpc(method, url, data=body, headers=headers, **self.httpc_params)
         except Exception as err:
@@ -168,6 +172,8 @@ def get_response(
 
         if 300 <= resp.status_code < 400:
             return {"http_response": resp}
+        elif resp.status_code >= 400:
+            logger.error(f"HTTP error: {resp}")
 
         if resp.status_code < 300:
             if "keyjar" not in kwargs:
@@ -213,14 +219,10 @@ def service_request(
 
         logger.debug(REQUEST_INFO.format(url, method, body, headers))
 
-        try:
-            response = service.get_response_ext(
-                url, method, body, response_body_type, headers, **kwargs
-            )
-        except AttributeError:
-            response = self.get_response(
-                service, url, method, body, response_body_type, headers, **kwargs
-            )
+        _get_response_func = getattr(self, "get_response_ext", getattr(self, "get_response"))
+        response = _get_response_func(
+            service, url, method, body, response_body_type, headers, **kwargs
+        )
 
         if "error" in response:
             pass
@@ -333,6 +335,7 @@ def dynamic_provider_info_discovery(client: Client, behaviour_args: Optional[dic
     except KeyError:
         pass
 
+    logger.debug(f"{service}")
     response = client.do_request(service, behaviour_args=behaviour_args)
     if is_error_message(response):
         raise OidcServiceError(response["error"])
diff --git a/src/idpyoidc/client/oauth2/access_token.py b/src/idpyoidc/client/oauth2/access_token.py
index 7030a531..6ccb6f49 100644
--- a/src/idpyoidc/client/oauth2/access_token.py
+++ b/src/idpyoidc/client/oauth2/access_token.py
@@ -34,8 +34,8 @@ class AccessToken(Service):
         "token_endpoint_auth_signing_alg": get_signing_algs,
     }
 
-    def __init__(self, upstream_get, conf=None):
-        Service.__init__(self, upstream_get, conf=conf)
+    def __init__(self, upstream_get, conf=None, **kwargs):
+        Service.__init__(self, upstream_get, conf=conf, **kwargs)
         self.pre_construct.append(self.oauth_pre_construct)
 
     def update_service_context(self, resp, key: Optional[str] = "", **kwargs):
diff --git a/src/idpyoidc/client/oauth2/add_on/par.py b/src/idpyoidc/client/oauth2/add_on/par.py
index fb5fa9b7..db358e8f 100644
--- a/src/idpyoidc/client/oauth2/add_on/par.py
+++ b/src/idpyoidc/client/oauth2/add_on/par.py
@@ -6,6 +6,7 @@
 from idpyoidc.client.client_auth import CLIENT_AUTHN_METHOD
 from idpyoidc.message import Message
 from idpyoidc.message.oauth2 import JWTSecuredAuthorizationRequest
+from idpyoidc.server.util import execute
 from idpyoidc.util import instantiate
 from requests import request
 
@@ -21,24 +22,41 @@ def push_authorization(request_args, service, **kwargs):
 
     _context = service.upstream_get("context")
     method_args = _context.add_on["pushed_authorization"]
+    logger.debug(f"PAR method args: {method_args}")
+    logger.debug(f"PAR kwargs: {kwargs}")
+
     if method_args["apply"] is False:
         return request_args
 
     _http_method = method_args["http_client"]
+    _httpc_params = service.upstream_get("unit").httpc_params
 
     # Add client authentication if needed
     _headers = {}
     authn_method = method_args["authn_method"]
     if authn_method:
-        if authn_method not in _context.client_authn_methods:
-            _context.client_authn_methods[authn_method] = CLIENT_AUTHN_METHOD[authn_method]()
+        if isinstance(authn_method, str):
+            if authn_method not in _context.client_authn_methods:
+                _context.client_authn_methods[authn_method] = CLIENT_AUTHN_METHOD[authn_method]()
+        else:
+            _name = ""
+            for _name, spec in authn_method.items():
+                if _name not in _context.client_authn_methods:
+                    _context.client_authn_methods[_name] = execute(spec)
+            authn_method = _name
 
         _args = {}
         if _context.issuer:
             _args["iss"] = _context.issuer
+        if _name == "client_attestation":
+            _wia = kwargs.get("client_attestation")
+            if _wia:
+                _args["client_attestation"] = _wia
+
         _headers = service.get_headers(
             request_args, http_method=_http_method, authn_method=authn_method, **_args
         )
+        _headers["Content-Type"] = "application/x-www-form-urlencoded"
 
     # construct the message body
     if method_args["body_format"] == "urlencoded":
@@ -56,12 +74,13 @@ def push_authorization(request_args, service, **kwargs):
 
         _body = _msg.to_urlencoded()
 
-    # Send it to the Pushed Authorization Request Endpoint
+    # Send it to the Pushed Authorization Request Endpoint using POST
     resp = _http_method(
-        method="GET",
+        method="POST",
         url=_context.provider_info["pushed_authorization_request_endpoint"],
         data=_body,
         headers=_headers,
+        **_httpc_params
     )
 
     if resp.status_code == 200:
diff --git a/src/idpyoidc/client/oauth2/server_metadata.py b/src/idpyoidc/client/oauth2/server_metadata.py
index 8fe4ecc9..370256d5 100644
--- a/src/idpyoidc/client/oauth2/server_metadata.py
+++ b/src/idpyoidc/client/oauth2/server_metadata.py
@@ -121,16 +121,34 @@ def _update_service_context(self, resp):
         try:
             _keyjar = self.upstream_get("attribute", "keyjar")
             if _keyjar is None:
+                LOGGER.debug("No existing KeyJar")
                 _keyjar = KeyJar()
         except KeyError:
             _keyjar = KeyJar()
 
+        _loaded = False
         # Load the keys. Note that this only means that the key specification
         # is loaded not necessarily that any keys are fetched.
         if "jwks_uri" in resp:
+            LOGGER.debug(f"'jwks_uri' in provider info: {resp['jwks_uri']}")
+            _hp = self.upstream_get('entity').httpc_params
+            if "verify" in _hp and "verify" not in _keyjar.httpc_params:
+                _keyjar.httpc_params["verify"] = _hp["verify"]
             _keyjar.load_keys(_pcr_issuer, jwks_uri=resp["jwks_uri"])
+            _loaded = True
         elif "jwks" in resp:
+            LOGGER.debug("'jwks' in provider info")
             _keyjar.load_keys(_pcr_issuer, jwks=resp["jwks"])
+            _loaded = True
+        else:
+            LOGGER.debug("Neither jws or jwks_uri in provider info")
+
+        if _loaded:
+            LOGGER.debug(f"loaded keys for: {_pcr_issuer}")
+            LOGGER.debug(f"keys = {_keyjar.key_summary(_pcr_issuer)}")
+            LOGGER.debug(f"{_keyjar}")
+        else:
+            LOGGER.debug(f"Did not load any keys for {_pcr_issuer}")
 
         # Combine what I prefer/supports with what the Provider supports
         if isinstance(resp, Message):
diff --git a/src/idpyoidc/client/oauth2/stand_alone_client.py b/src/idpyoidc/client/oauth2/stand_alone_client.py
index c4d219c8..8652f56d 100644
--- a/src/idpyoidc/client/oauth2/stand_alone_client.py
+++ b/src/idpyoidc/client/oauth2/stand_alone_client.py
@@ -436,6 +436,7 @@ def finalize_auth(self, response: dict, behaviour_args: Optional[dict] = None):
             # got it from the wrong bloke
             raise ValueError("Impersonator {}".format(issuer))
 
+        _context.cstate.update(authorization_response["state"], authorization_response)
         _srv.update_service_context(authorization_response, key=authorization_response["state"])
         return authorization_response
 
diff --git a/src/idpyoidc/client/oauth2/utils.py b/src/idpyoidc/client/oauth2/utils.py
index 5b8a365d..254e1bd2 100644
--- a/src/idpyoidc/client/oauth2/utils.py
+++ b/src/idpyoidc/client/oauth2/utils.py
@@ -76,8 +76,12 @@ def pick_redirect_uri(
         if redirect_uris:
             redirect_uri = redirect_uris[0]
         else:
-            logger.error("No redirect_uri")
-            raise MissingRequiredAttribute("redirect_uri")
+            redirect_uris = context.get_preference("redirect_uris", [])
+            if redirect_uris:
+                redirect_uri = redirect_uris[0]
+            else:
+                logger.error("No redirect_uri")
+                raise MissingRequiredAttribute("redirect_uri")
 
     return redirect_uri
 
diff --git a/src/idpyoidc/client/rp_handler.py b/src/idpyoidc/client/rp_handler.py
index acbad9e5..891e8902 100644
--- a/src/idpyoidc/client/rp_handler.py
+++ b/src/idpyoidc/client/rp_handler.py
@@ -186,6 +186,7 @@ def init_client(self, issuer):
         if self.jwks_uri:
             _cnf["jwks_uri"] = self.jwks_uri
 
+        logger.debug(f"config: {_cnf}")
         try:
             client = self.client_cls(
                 services=_services,
diff --git a/src/idpyoidc/client/service.py b/src/idpyoidc/client/service.py
index f2348c77..231d56b0 100644
--- a/src/idpyoidc/client/service.py
+++ b/src/idpyoidc/client/service.py
@@ -8,9 +8,11 @@
 from typing import Union
 from urllib.parse import urlparse
 
+from cryptojwt.exception import IssuerNotFound
 from cryptojwt.jwe.jwe import factory as jwe_factory
 from cryptojwt.jws.jws import factory as jws_factory
 from cryptojwt.jwt import JWT
+from idpyoidc.exception import MissingSigningKey
 
 from idpyoidc.client.exception import Unsupported
 from idpyoidc.impexp import ImpExp
@@ -384,8 +386,9 @@ def get_headers(
         )
 
         _authz = _headers.get("Authorization")
-        if _authz and _authz.startswith("Bearer"):
-            kwargs["token"] = _authz.split(" ")[1]
+        if _authz:
+            if _authz.startswith("Bearer") or _authz.startswith("DPoP"):
+                kwargs["token"] = _authz.split(" ")[1]
 
         for meth in self.construct_extra_headers:
             _headers = meth(
@@ -493,7 +496,7 @@ def get_urlinfo(info):
 
     def post_parse_response(self, response, **kwargs):
         """
-        This method does post processing of the service response.
+        This method does post-processing of the service response.
         Each service have their own version of this method.
 
         :param response: The service response
@@ -539,6 +542,9 @@ def _do_jwt(self, info):
     def _do_response(self, info, sformat, **kwargs):
         _context = self.upstream_get("context")
 
+        if isinstance(info,  list): # Don't have support for sformat=list
+            return info
+
         try:
             resp = self.response_cls().deserialize(info, sformat, iss=_context.issuer, **kwargs)
         except Exception as err:
@@ -566,7 +572,7 @@ def parse_response(
         state: Optional[str] = "",
         behaviour_args: Optional[dict] = None,
         **kwargs,
-    ):
+    ) :
         """
         This the start of a pipeline that will:
 
@@ -628,7 +634,9 @@ def parse_response(
         LOGGER.debug("response_cls: %s", self.response_cls.__name__)
 
         if resp is None:
-            if not info:
+            if self.response_cls == list and info == []:
+                return info
+            elif not info:
                 LOGGER.error("Missing or faulty response")
                 raise ResponseError("Missing or faulty response")
 
@@ -636,19 +644,27 @@ def parse_response(
                 resp = info
             else:
                 resp = self._do_response(info, sformat, **kwargs)
-                LOGGER.debug('Initial response parsing => "%s"', resp.to_dict())
+                if isinstance(resp, Message):
+                    LOGGER.debug(f'Initial response parsing => "{resp.to_dict()}"')
+                else:
+                    LOGGER.debug(f'Initial response parsing => "{resp}"')
 
         # is this an error message
         if sformat == "text":
             pass
         elif is_error_message(resp):
             LOGGER.debug("Error response: %s", resp)
-        else:
+        elif isinstance(resp, Message):
             vargs = self.gather_verify_arguments(response=resp, behaviour_args=behaviour_args)
             LOGGER.debug("Verify response with %s", vargs)
             try:
                 # verify the message. If something is wrong an exception is thrown
                 resp.verify(**vargs)
+            except MissingSigningKey as err:
+                LOGGER.error(f"Could not find an appropriate key: {err}")
+                if vargs["iss"] not in vargs["keyjar"].owners():
+                    LOGGER.debug(f"Issuer {vargs['iss']} not found in keyjar")
+                raise
             except Exception as err:
                 LOGGER.error("Got exception while verifying response: %s", err)
                 raise
diff --git a/src/idpyoidc/client/state_interface.py b/src/idpyoidc/client/state_interface.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/idpyoidc/combo/__init__.py b/src/idpyoidc/combo/__init__.py
new file mode 100644
index 00000000..a04d0981
--- /dev/null
+++ b/src/idpyoidc/combo/__init__.py
@@ -0,0 +1,62 @@
+from typing import Optional
+from typing import Union
+
+from cryptojwt import KeyJar
+
+from idpyoidc.configure import Configuration
+from idpyoidc.node import Unit
+from idpyoidc.server.util import execute
+
+
+class Combo(Unit):
+    name = 'root'
+
+    def __init__(self,
+                 config: Union[dict, Configuration],
+                 httpc: Optional[object] = None,
+                 entity_id: Optional[str] = '',
+                 keyjar: Optional[Union[KeyJar, bool]] = None,
+                 httpc_params: Optional[dict] = None
+                 ):
+        self.entity_id = entity_id or config.get('entity_id')
+        if not httpc_params:
+            httpc_params = self._get_httpc_params(config)
+
+        Unit.__init__(self, config=config, httpc=httpc, issuer_id=self.entity_id, keyjar=keyjar)
+        self._part = {}
+        for key, spec in config.items():
+            if isinstance(spec, dict) and 'class' in spec:
+                if httpc_params:
+                    self._add_httpc_params(spec, httpc_params)
+                self._part[key] = execute(spec, upstream_get=self.unit_get,
+                                          entity_id=self.entity_id, httpc=httpc)
+
+    def _get_httpc_params(self, config):
+        return config.get("httpc_params")
+
+    def _add_httpc_params(self, spec, httpc_params):
+        spec_kwargs = spec.get("kwargs", {})
+        if "config" in spec_kwargs:
+            if httpc_params and "httpc_params" not in spec_kwargs["config"]:
+                spec_kwargs["config"]["httpc_params"] = httpc_params
+        else:
+            if "httpc_params" not in spec_kwargs:
+                spec_kwargs["httpc_params"] = httpc_params
+
+    def __getitem__(self, item):
+        if item in self._part:
+            return self._part[item]
+        else:
+            return None
+
+    def __setitem__(self, key, value):
+        self._part[key] = value
+
+    def get_entity_types(self):
+        return list(self._part.keys())
+
+    def keys(self):
+        return self._part.keys()
+
+    def items(self):
+        return self._part.items()
diff --git a/src/idpyoidc/impexp.py b/src/idpyoidc/impexp.py
index 94592c0f..ff8938ea 100644
--- a/src/idpyoidc/impexp.py
+++ b/src/idpyoidc/impexp.py
@@ -1,12 +1,12 @@
+import base64
 from typing import Any
 from typing import List
 from typing import Optional
 
-from cryptojwt import as_unicode
-from cryptojwt.utils import as_bytes
 from cryptojwt.utils import importer
 from cryptojwt.utils import qualified_name
 
+# from idpyoidc.item import DLDict
 from idpyoidc.message import Message
 from idpyoidc.storage import DictType
 
@@ -15,6 +15,23 @@ def fully_qualified_name(cls):
     return cls.__module__ + "." + cls.__class__.__name__
 
 
+def type2cls(v):
+    if isinstance(v, str):
+        return ""
+    elif isinstance(v, int):
+        return 0
+    elif isinstance(v, bool):
+        return bool
+    elif isinstance(v, bytes):
+        return b""
+    elif isinstance(v, dict):
+        return {}
+    elif isinstance(v, list):
+        return []
+    else:
+        return None
+
+
 class ImpExp:
     parameter = {}
     special_load_dump = {}
@@ -24,11 +41,14 @@ def __init__(self):
         pass
 
     def dump_attr(self, cls, item, exclude_attributes: Optional[List[str]] = None) -> dict:
-        if cls in [None, 0, "", [], {}, bool, b""]:
-            if cls == b"":
-                val = as_unicode(item)
-            else:
-                val = item
+        if cls in [None, 0, "", bool]:
+            val = item
+        elif cls == b"":
+            val = f"BYTES:{base64.b64encode(item).decode('utf-8')}"
+        elif cls == {} and isinstance(item, dict):
+            val = {k: self.dump_attr(type2cls(v), v, exclude_attributes) for k, v in item.items()}
+        elif cls == [] and isinstance(item, list):
+            val = [self.dump_attr(type2cls(v), v, exclude_attributes) for v in item]
         elif cls == "DICT_TYPE":
             if isinstance(item, dict):
                 val = item
@@ -78,11 +98,11 @@ def local_load_adjustments(self, **kwargs):
         pass
 
     def load_attr(
-        self,
-        cls: Any,
-        item: dict,
-        init_args: Optional[dict] = None,
-        load_args: Optional[dict] = None,
+            self,
+            cls: Any,
+            item: Any,
+            init_args: Optional[dict] = None,
+            load_args: Optional[dict] = None,
     ) -> Any:
         if load_args:
             _kwargs = {"load_args": load_args}
@@ -92,11 +112,17 @@ def load_attr(
         if init_args:
             _kwargs["init_args"] = init_args
 
-        if cls in [None, 0, "", [], {}, bool, b""]:
-            if cls == b"":
-                val = as_bytes(item)
+        if cls in [None, 0, "", bool]:
+            if cls == "" and item.startswith("BYTES:"):
+                val = base64.b64decode(item[len("BYTES:"):].encode("utf-8"))
             else:
                 val = item
+        elif cls == b"":
+            val = base64.b64decode(item[len("BYTES:"):].encode("utf-8"))
+        elif cls == {}:
+            val = {k: self.load_attr(type2cls(v), v, init_args, load_args) for k, v in item.items()}
+        elif cls == []:
+            val = [self.load_attr(type2cls(v), v, init_args, load_args) for v in item]
         elif cls == "DICT_TYPE":
             if list(item.keys()) == ["DICT_TYPE"]:
                 _spec = item["DICT_TYPE"]
@@ -127,7 +153,10 @@ def load_attr(
             else:
                 _args = {}
 
-            val = cls(**_args).load(item, **_kwargs)
+            if item:
+                val = cls(**_args).load(item, **_kwargs)
+            else:
+                val = cls(**_args)
 
         return val
 
diff --git a/src/idpyoidc/node.py b/src/idpyoidc/node.py
index 4256a5f1..25b1f406 100644
--- a/src/idpyoidc/node.py
+++ b/src/idpyoidc/node.py
@@ -3,10 +3,8 @@
 from typing import Union
 
 from cryptojwt import KeyJar
-from cryptojwt.key_jar import build_keyjar
 from cryptojwt.key_jar import init_key_jar
 
-from idpyoidc.client.defaults import DEFAULT_KEY_DEFS
 from idpyoidc.configure import Configuration
 from idpyoidc.impexp import ImpExp
 from idpyoidc.util import instantiate
@@ -46,11 +44,11 @@ def create_keyjar(
 
 
 def make_keyjar(
-    keyjar: Optional[Union[KeyJar, bool]] = None,
-    config: Optional[Union[Configuration, dict]] = None,
-    key_conf: Optional[dict] = None,
-    issuer_id: Optional[str] = "",
-    client_id: Optional[str] = "",
+        keyjar: Optional[Union[KeyJar, bool]] = None,
+        config: Optional[Union[Configuration, dict]] = None,
+        key_conf: Optional[dict] = None,
+        issuer_id: Optional[str] = "",
+        client_id: Optional[str] = "",
 ):
     if keyjar is False:
         return None
@@ -80,10 +78,10 @@ def make_keyjar(
                 keyjar = KeyJar()
                 keyjar.add_symmetric(client_id, _key)
                 keyjar.add_symmetric("", _key)
-        else:
-            keyjar = build_keyjar(DEFAULT_KEY_DEFS)
-            if issuer_id:
-                keyjar.import_jwks(keyjar.export_jwks(private=True), issuer_id)
+        # else:
+        #     keyjar = build_keyjar(DEFAULT_KEY_DEFS)
+        #     if issuer_id:
+        #         keyjar.import_jwks(keyjar.export_jwks(private=True), issuer_id)
 
     return keyjar
 
diff --git a/src/idpyoidc/server/__init__.py b/src/idpyoidc/server/__init__.py
index 0509feeb..6e93aea0 100644
--- a/src/idpyoidc/server/__init__.py
+++ b/src/idpyoidc/server/__init__.py
@@ -7,15 +7,14 @@
 
 from cryptojwt import KeyJar
 
+from idpyoidc.client.defaults import DEFAULT_KEY_DEFS
 from idpyoidc.node import Unit
-
 # from idpyoidc.server import authz
 # from idpyoidc.server.client_authn import client_auth_setup
 from idpyoidc.server.configure import ASConfiguration
 from idpyoidc.server.configure import OPConfiguration
 from idpyoidc.server.endpoint import Endpoint
 from idpyoidc.server.endpoint_context import EndpointContext
-
 # from idpyoidc.server.session.manager import create_session_manager
 # from idpyoidc.server.user_authn.authn_context import populate_authn_broker
 from idpyoidc.server.util import allow_refresh_token
@@ -36,19 +35,26 @@ class Server(Unit):
     parameter = {"endpoint": [Endpoint], "context": EndpointContext}
 
     def __init__(
-        self,
-        conf: Union[dict, OPConfiguration, ASConfiguration],
-        keyjar: Optional[KeyJar] = None,
-        cwd: Optional[str] = "",
-        cookie_handler: Optional[Any] = None,
-        httpc: Optional[Callable] = None,
-        upstream_get: Optional[Callable] = None,
-        httpc_params: Optional[dict] = None,
-        entity_id: Optional[str] = "",
-        key_conf: Optional[dict] = None,
+            self,
+            conf: Union[dict, OPConfiguration, ASConfiguration],
+            keyjar: Optional[KeyJar] = None,
+            cwd: Optional[str] = "",
+            cookie_handler: Optional[Any] = None,
+            httpc: Optional[Callable] = None,
+            upstream_get: Optional[Callable] = None,
+            httpc_params: Optional[dict] = None,
+            entity_id: Optional[str] = "",
+            key_conf: Optional[dict] = None,
     ):
         self.entity_id = entity_id or conf.get("entity_id")
         self.issuer = conf.get("issuer", self.entity_id)
+        self.persistence = None
+
+        if upstream_get is None:
+            if key_conf is None:
+                _conf = conf.get("key_conf")
+                if _conf is None:
+                    key_conf = {"key_defs": DEFAULT_KEY_DEFS}
 
         Unit.__init__(
             self,
diff --git a/src/idpyoidc/server/client_authn.py b/src/idpyoidc/server/client_authn.py
index 205a5854..f250c31b 100755
--- a/src/idpyoidc/server/client_authn.py
+++ b/src/idpyoidc/server/client_authn.py
@@ -225,15 +225,21 @@ def _verify(
         get_client_id_from_token: Optional[Callable] = None,
         **kwargs,
     ):
+        logger.debug(f"Client Auth method: {self.tag}")
         token = authorization_token.split(" ", 1)[1]
         _context = self.upstream_get("context")
-        try:
-            client_id = get_client_id_from_token(_context, token, request)
-        except ToOld:
-            raise BearerTokenAuthenticationError("Expired token")
-        except KeyError:
-            raise BearerTokenAuthenticationError("Unknown token")
-        return {"token": token, "client_id": client_id}
+        client_id = ""
+        if get_client_id_from_token:
+            try:
+                client_id = get_client_id_from_token(_context, token, request)
+            except ToOld:
+                raise BearerTokenAuthenticationError("Expired token")
+            except KeyError:
+                raise BearerTokenAuthenticationError("Unknown token")
+            except Exception as err:
+                logger.debug(f"Exception in {self.tag}")
+
+        return {"token": token, "client_id": client_id, "method": self.tag}
 
 
 class BearerBody(ClientSecretPost):
@@ -435,10 +441,11 @@ def _verify(
 TYPE_METHOD = [(JWT_BEARER, JWSAuthnMethod)]
 
 
-def valid_client_info(cinfo):
-    eta = cinfo.get("client_secret_expires_at", 0)
-    if eta != 0 and eta < utc_time_sans_frac():
-        return False
+def valid_client_secret(cinfo):
+    if "client_secret" in cinfo:
+        eta = cinfo.get("client_secret_expires_at", 0)
+        if eta != 0 and eta < utc_time_sans_frac():
+            return False
     return True
 
 
@@ -472,8 +479,6 @@ def verify_client(
 
     auth_info = {}
 
-    # 'methods' refer to all client authentication methods that can be used by a server.
-    # 'allowed_methods' are the ones that can be used by a specific endpoint.
     _context = endpoint.upstream_get("context")
     methods = _context.client_authn_methods
 
@@ -501,6 +506,8 @@ def verify_client(
             logger.info("Verifying auth using {} failed: {}".format(_method.tag, err))
             continue
 
+        logger.debug(f"Verify returned: {auth_info}")
+
         if auth_info.get("method") == "none" and auth_info.get("client_id") is None:
             break
 
@@ -524,8 +531,8 @@ def verify_client(
         if not _cinfo:
             raise UnknownClient("Unknown Client ID")
 
-        if not valid_client_info(_cinfo):
-            logger.warning("Client registration has timed out or " "client secret is expired.")
+        if not valid_client_secret(_cinfo):
+            logger.warning("Client secret has expired.")
             raise InvalidClient("Not valid client")
 
         # Validate that the used method is allowed for this client/endpoint
@@ -541,6 +548,8 @@ def verify_client(
             continue
         break
 
+    logger.debug(f"Authn methods applied")
+
     # store what authn method was used
     if "method" in auth_info and client_id:
         _request_type = request.__class__.__name__
diff --git a/src/idpyoidc/server/configure.py b/src/idpyoidc/server/configure.py
index 544a98da..3f304e7c 100755
--- a/src/idpyoidc/server/configure.py
+++ b/src/idpyoidc/server/configure.py
@@ -9,6 +9,7 @@
 
 from idpyoidc.client.defaults import OAUTH2_SERVER_METADATA_URL
 from idpyoidc.configure import Base
+from idpyoidc.server.client_authn import CLIENT_AUTHN_METHOD
 from idpyoidc.server.client_configure import verify_oidc_client_information
 from idpyoidc.server.scopes import SCOPE2CLAIMS
 
@@ -605,6 +606,8 @@ def __init__(
             },
         },
     },
+    "base_url": "https://{domain}:{port}",
+    "client_authn_methods": CLIENT_AUTHN_METHOD
 }
 
 DEFAULT_OIDC_ENDPOINTS = {
diff --git a/src/idpyoidc/server/endpoint.py b/src/idpyoidc/server/endpoint.py
index 3abc5343..256f0029 100755
--- a/src/idpyoidc/server/endpoint.py
+++ b/src/idpyoidc/server/endpoint.py
@@ -84,6 +84,7 @@ class Endpoint(Node):
     error_cls = ResponseMessage
     endpoint_name = ""
     endpoint_path = ""
+    endpoint_type = ""
     name = ""
     request_format = "urlencoded"
     request_placement = "query"
@@ -227,18 +228,20 @@ def parse_request(
 
         # Verify that the client is allowed to do this
         auth_info = self.client_authentication(req, http_info, endpoint=self, **kwargs)
+        LOGGER.debug(f"parse_request:auth_info:{auth_info}")
 
-        if "client_id" in auth_info:
-            req["client_id"] = auth_info["client_id"]
+        _client_id = auth_info.get("client_id", "")
+        if _client_id:
+            req["client_id"] = _client_id
 
             _auth_method = auth_info.get("method")
             if _auth_method and _auth_method not in ["public", "none"]:
                 req["authenticated"] = True
-
-            _client_id = auth_info["client_id"]
         else:
             _client_id = req.get("client_id")
 
+        LOGGER.debug(f"parse_request:auth_info:{auth_info}")
+
         # verify that the request message is correct, may have to do it twice
         err_response = self.verify_request(
             request=req, keyjar=_keyjar, client_id=_client_id, verify_args=verify_args
diff --git a/src/idpyoidc/server/oauth2/add_on/dpop.py b/src/idpyoidc/server/oauth2/add_on/dpop.py
index 1c07648a..8deba5cd 100644
--- a/src/idpyoidc/server/oauth2/add_on/dpop.py
+++ b/src/idpyoidc/server/oauth2/add_on/dpop.py
@@ -147,7 +147,7 @@ def userinfo_post_parse_request(request, client_id, context, auth_info, **kwargs
     # The signature of the JWS is verified, now for checking the
     # content
 
-    if _dpop["htu"] != _http_info["url"]:
+    if _dpop["htu"] != _http_info["url"].split('?')[0]:
         raise ValueError("htu in DPoP does not match the HTTP URI")
 
     if _dpop["htm"] != _http_info["method"]:
@@ -209,8 +209,8 @@ def add_support(endpoint: dict, **kwargs):
 class DPoPClientAuth(BearerHeader):
     tag = "dpop_client_auth"
 
-    def is_usable(self, request=None, authorization_info=None, http_headers=None):
-        if authorization_info is not None and authorization_info.startswith("DPoP "):
+    def is_usable(self, request=None, authorization_token=None, http_headers=None):
+        if authorization_token is not None and authorization_token.startswith("DPoP "):
             return True
         return False
 
@@ -226,9 +226,4 @@ def verify(
         info = BearerHeader._verify(
             self, request, authorization_token, endpoint, get_client_id_from_token, **kwargs
         )
-        _context = self.upstream_get("context")
-        return {"client_id": ""}
-        # if _context.cdb[client_info["id"]]["client_secret"] == client_info["secret"]:
-        #     return {"client_id": client_info["id"]}
-        # else:
-        #     raise ClientAuthenticationError()
+        return info
diff --git a/src/idpyoidc/server/oauth2/authorization.py b/src/idpyoidc/server/oauth2/authorization.py
index 60c0f983..58cad0ff 100755
--- a/src/idpyoidc/server/oauth2/authorization.py
+++ b/src/idpyoidc/server/oauth2/authorization.py
@@ -97,6 +97,7 @@ def verify_uri(
     request: Union[dict, Message],
     uri_type: str,
     client_id: Optional[str] = None,
+    endpoint_type: Optional[str] = 'oidc'
 ):
     """
     A redirect URI
@@ -138,7 +139,8 @@ def verify_uri(
         redirect_uris = client_info.get(f"{uri_type}")
 
     if redirect_uris is None:
-        raise RedirectURIError(f"No registered {uri_type} for {_cid}")
+        if endpoint_type == "oidc":
+            raise RedirectURIError(f"No registered {uri_type} for {_cid}")
     else:
         match = False
         for _item in redirect_uris:
@@ -194,7 +196,10 @@ def join_query(base, query):
         return base
 
 
-def get_uri(context, request, uri_type):
+def get_uri(context,
+            request: Union[Message, dict],
+            uri_type: str,
+            endpoint_type: Optional[str] = "oidc"):
     """verify that the redirect URI is reasonable.
 
     :param context: An EndpointContext instance
@@ -205,7 +210,7 @@ def get_uri(context, request, uri_type):
     uri = ""
 
     if uri_type in request:
-        verify_uri(context, request, uri_type)
+        verify_uri(context, request, uri_type,endpoint_type=endpoint_type)
         uri = request[uri_type]
     else:
         uris = f"{uri_type}s"
@@ -344,6 +349,7 @@ class Authorization(Endpoint):
     response_placement = "url"
     endpoint_name = "authorization_endpoint"
     name = "authorization"
+    endpoint_type = "oauth2"
 
     _supports = {
         "claims_parameter_supported": True,
@@ -512,7 +518,7 @@ def _post_parse_request(self, request, client_id, context, **kwargs):
 
         # Get a verified redirect URI
         try:
-            redirect_uri = get_uri(context, request, "redirect_uri")
+            redirect_uri = get_uri(context, request, "redirect_uri", self.endpoint_type)
         except (RedirectURIError, ParameterError) as err:
             return self.authentication_error_response(
                 request,
@@ -980,7 +986,7 @@ def post_authentication(self, request: Union[dict, Message], session_id: str, **
         logger.debug("Known clients: {}".format(list(_context.cdb.keys())))
 
         try:
-            redirect_uri = get_uri(_context, request, "redirect_uri")
+            redirect_uri = get_uri(_context, request, "redirect_uri", self.endpoint_type)
         except (RedirectURIError, ParameterError) as err:
             return self.error_response(
                 response_info, request, "invalid_request", "{}".format(err.args)
diff --git a/src/idpyoidc/server/oauth2/introspection.py b/src/idpyoidc/server/oauth2/introspection.py
index 9f48714b..096d666e 100644
--- a/src/idpyoidc/server/oauth2/introspection.py
+++ b/src/idpyoidc/server/oauth2/introspection.py
@@ -19,6 +19,7 @@ class Introspection(Endpoint):
     request_format = "urlencoded"
     response_format = "json"
     endpoint_name = "introspection_endpoint"
+    endpoint_type = "oauth2"
     name = "introspection"
     _supports = {
         "client_authn_method": [
diff --git a/src/idpyoidc/server/oauth2/pushed_authorization.py b/src/idpyoidc/server/oauth2/pushed_authorization.py
index 065bda04..693b073f 100644
--- a/src/idpyoidc/server/oauth2/pushed_authorization.py
+++ b/src/idpyoidc/server/oauth2/pushed_authorization.py
@@ -17,6 +17,7 @@ class PushedAuthorization(Authorization):
     response_placement = "body"
     response_format = "json"
     name = "pushed_authorization"
+    endpoint_type = "oauth2"
 
     def __init__(self, upstream_get, **kwargs):
         Authorization.__init__(self, upstream_get, **kwargs)
diff --git a/src/idpyoidc/server/oauth2/server_metadata.py b/src/idpyoidc/server/oauth2/server_metadata.py
index 2f9cea10..544339e9 100755
--- a/src/idpyoidc/server/oauth2/server_metadata.py
+++ b/src/idpyoidc/server/oauth2/server_metadata.py
@@ -12,6 +12,7 @@ class ServerMetadata(Endpoint):
     request_format = ""
     response_format = "json"
     name = "server_metadata"
+    endpoint_type = "oauth2"
 
     def __init__(self, upstream_get, **kwargs):
         Endpoint.__init__(self, upstream_get=upstream_get, **kwargs)
diff --git a/src/idpyoidc/server/oauth2/token.py b/src/idpyoidc/server/oauth2/token.py
index aea552a5..30d34fb5 100755
--- a/src/idpyoidc/server/oauth2/token.py
+++ b/src/idpyoidc/server/oauth2/token.py
@@ -35,6 +35,7 @@ class Token(Endpoint):
     name = "token"
     default_capabilities = {"token_endpoint_auth_signing_alg_values_supported": None}
     token_exchange_helper = TokenExchangeHelper
+    endpoint_type = "oauth2"
 
     helper_by_grant_type = {
         "authorization_code": AccessTokenHelper,
diff --git a/src/idpyoidc/server/oauth2/token_revocation.py b/src/idpyoidc/server/oauth2/token_revocation.py
index d36ed28b..80e20e35 100644
--- a/src/idpyoidc/server/oauth2/token_revocation.py
+++ b/src/idpyoidc/server/oauth2/token_revocation.py
@@ -22,7 +22,9 @@ class TokenRevocation(Endpoint):
     response_format = "text"
     response_body_type = "text"
     endpoint_name = "revocation_endpoint"
+    endpoint_type = "oauth2"
     name = "token_revocation"
+
     default_capabilities = {
         "client_authn_method": [
             "client_secret_basic",
diff --git a/src/idpyoidc/server/oidc/authorization.py b/src/idpyoidc/server/oidc/authorization.py
index 44602206..e6daad35 100644
--- a/src/idpyoidc/server/oidc/authorization.py
+++ b/src/idpyoidc/server/oidc/authorization.py
@@ -75,6 +75,7 @@ class Authorization(authorization.Authorization):
     response_placement = "url"
     endpoint_name = "authorization_endpoint"
     name = "authorization"
+    endpoint_type = "oidc"
 
     _supports = {
         **authorization.Authorization._supports,
diff --git a/src/idpyoidc/server/oidc/backchannel_authentication.py b/src/idpyoidc/server/oidc/backchannel_authentication.py
index d498a63c..b193e223 100644
--- a/src/idpyoidc/server/oidc/backchannel_authentication.py
+++ b/src/idpyoidc/server/oidc/backchannel_authentication.py
@@ -35,6 +35,7 @@ class BackChannelAuthentication(Endpoint):
     response_placement = "url"
     endpoint_name = "backchannel_authentication_endpoint"
     name = "backchannel_authentication"
+    endpoint_type = "oidc"
 
     _supports = {
         "backchannel_token_delivery_modes_supported": ["poll", "ping", "push"],
diff --git a/src/idpyoidc/server/oidc/discovery.py b/src/idpyoidc/server/oidc/discovery.py
index 70767c75..a57c583f 100755
--- a/src/idpyoidc/server/oidc/discovery.py
+++ b/src/idpyoidc/server/oidc/discovery.py
@@ -12,6 +12,7 @@ class Discovery(Endpoint):
     request_format = "urlencoded"
     response_format = "json"
     name = "discovery"
+    endpoint_type = "oidc"
 
     def do_response(self, response_args=None, request=None, **kwargs):
         """
diff --git a/src/idpyoidc/server/oidc/provider_config.py b/src/idpyoidc/server/oidc/provider_config.py
index 51f9a9d4..819a6997 100755
--- a/src/idpyoidc/server/oidc/provider_config.py
+++ b/src/idpyoidc/server/oidc/provider_config.py
@@ -12,6 +12,7 @@ class ProviderConfiguration(Endpoint):
     request_format = ""
     response_format = "json"
     name = "provider_config"
+    endpoint_type = "oidc"
 
     def __init__(self, upstream_get, **kwargs):
         Endpoint.__init__(self, upstream_get=upstream_get, **kwargs)
diff --git a/src/idpyoidc/server/oidc/read_registration.py b/src/idpyoidc/server/oidc/read_registration.py
index e824415c..c74332e4 100644
--- a/src/idpyoidc/server/oidc/read_registration.py
+++ b/src/idpyoidc/server/oidc/read_registration.py
@@ -13,6 +13,7 @@ class RegistrationRead(Endpoint):
     request_placement = "url"
     response_format = "json"
     name = "registration_read"
+    endpoint_type = "oidc"
 
     def get_client_id_from_token(self, context, token, request=None):
         if "client_id" in request:
diff --git a/src/idpyoidc/server/oidc/registration.py b/src/idpyoidc/server/oidc/registration.py
index 5437f74e..1b8f0bed 100644
--- a/src/idpyoidc/server/oidc/registration.py
+++ b/src/idpyoidc/server/oidc/registration.py
@@ -4,6 +4,7 @@
 import logging
 import secrets
 from typing import List
+from typing import Optional
 from urllib.parse import urlencode
 from urllib.parse import urlparse
 
@@ -124,6 +125,7 @@ class Registration(Endpoint):
     response_format = "json"
     endpoint_name = "registration_endpoint"
     name = "registration"
+    endpoint_type = "oidc"
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -282,12 +284,7 @@ def do_client_registration(self, request, client_id, ignore=None):
         # if it can't load keys because the URL is false it will
         # just silently fail. Waiting for better times.
         _keyjar.load_keys(client_id, jwks_uri=t["jwks_uri"], jwks=t["jwks"])
-
-        n_keys = 0
-        for kb in _keyjar.get(client_id, []):
-            n_keys += len(kb.keys())
-        msg = "found {} keys for client_id={}"
-        logger.debug(msg.format(n_keys, client_id))
+        logger.debug(f"Keys for {client_id}: {_keyjar.key_summary(client_id)}")
 
         return _cinfo
 
@@ -402,7 +399,10 @@ def add_client_secret(self, cinfo, client_id, context):
 
         return client_secret
 
-    def client_registration_setup(self, request, new_id=True, set_secret=True):
+    def client_registration_setup(self, request,
+                                  new_id: Optional[bool] = True,
+                                  set_secret: Optional[bool] = True,
+                                  reserved_client_id: Optional[list] = None):
         try:
             request.verify()
         except (MessageException, ValueError) as err:
@@ -432,7 +432,9 @@ def client_registration_setup(self, request, new_id=True, set_secret=True):
             else:
                 cid_generator = importer("idpyoidc.server.oidc.registration.random_client_id")
                 cid_gen_kwargs = {}
-            client_id = cid_generator(reserved=_context.cdb.keys(), **cid_gen_kwargs)
+            if not reserved_client_id:
+                reserved_client_id = _context.cdb.keys()
+            client_id = cid_generator(reserved=reserved_client_id, **cid_gen_kwargs)
             if "client_id" in request:
                 del request["client_id"]
         else:
@@ -487,7 +489,9 @@ def client_registration_setup(self, request, new_id=True, set_secret=True):
 
     def process_request(self, request=None, new_id=True, set_secret=True, **kwargs):
         try:
-            reg_resp = self.client_registration_setup(request, new_id, set_secret)
+            reserved_client_id = kwargs.get("reserved")
+            reg_resp = self.client_registration_setup(request, new_id, set_secret,
+                                                      reserved_client_id)
         except Exception as err:
             logger.error("client_registration_setup: %s", request)
             return ResponseMessage(
diff --git a/src/idpyoidc/server/oidc/session.py b/src/idpyoidc/server/oidc/session.py
index ee1a8460..9e6071e6 100644
--- a/src/idpyoidc/server/oidc/session.py
+++ b/src/idpyoidc/server/oidc/session.py
@@ -80,6 +80,7 @@ class Session(Endpoint):
     response_placement = "url"
     endpoint_name = "end_session_endpoint"
     name = "session"
+    endpoint_type = "oidc"
 
     _supports = {
         "frontchannel_logout_supported": True,
diff --git a/src/idpyoidc/server/oidc/token.py b/src/idpyoidc/server/oidc/token.py
index b927e597..3436df32 100755
--- a/src/idpyoidc/server/oidc/token.py
+++ b/src/idpyoidc/server/oidc/token.py
@@ -24,6 +24,7 @@ class Token(token.Token):
     endpoint_name = "token_endpoint"
     name = "token"
     default_capabilities = None
+    endpoint_type = "oidc"
 
     helper_by_grant_type = {
         "authorization_code": AccessTokenHelper,
diff --git a/src/idpyoidc/server/oidc/userinfo.py b/src/idpyoidc/server/oidc/userinfo.py
index 8b376e91..2134c9be 100755
--- a/src/idpyoidc/server/oidc/userinfo.py
+++ b/src/idpyoidc/server/oidc/userinfo.py
@@ -30,6 +30,8 @@ class UserInfo(Endpoint):
     response_placement = "body"
     endpoint_name = "userinfo_endpoint"
     name = "userinfo"
+    endpoint_type = "oidc"
+
     _supports = {
         "claim_types_supported": ["normal", "aggregated", "distributed"],
         "encrypt_userinfo_supported": True,
@@ -133,16 +135,33 @@ def process_request(self, request=None, **kwargs):
         if token.is_active() is False:
             return self.error_cls(error="invalid_token", error_description="Invalid Token")
 
-        _cntxt = self.upstream_get("context")
-        _claims_restriction = _cntxt.claims_interface.get_claims(
-            _session_info["branch_id"], scopes=token.scope, claims_release_point="userinfo"
-        )
-        info = _cntxt.claims_interface.get_user_claims(
-            _session_info["user_id"], claims_restriction=_claims_restriction
-        )
-        info["sub"] = _grant.sub
-        if _grant.add_acr_value("userinfo"):
-            info["acr"] = _grant.authentication_event["authn_info"]
+        allowed = True
+        _auth_event = _grant.authentication_event
+        # if the authentication is still active or offline_access is granted.
+        if not _auth_event["valid_until"] >= utc_time_sans_frac():
+            logger.debug(
+                "authentication not valid: {} > {}".format(
+                    datetime.fromtimestamp(_auth_event["valid_until"]),
+                    datetime.fromtimestamp(utc_time_sans_frac()),
+                )
+            )
+            allowed = False
+
+            # This has to be made more finegrained.
+            # if "offline_access" in session["authn_req"]["scope"]:
+            #     pass
+
+        if allowed:
+            _cntxt = self.upstream_get("context")
+            _claims_restriction = _cntxt.claims_interface.get_claims(
+                _session_info["branch_id"], scopes=token.scope, claims_release_point="userinfo"
+            )
+            info = _cntxt.claims_interface.get_user_claims(
+                _session_info["user_id"], claims_restriction=_claims_restriction
+            )
+            info["sub"] = _grant.sub
+            if _grant.add_acr_value("userinfo"):
+                info["acr"] = _grant.authentication_event["authn_info"]
 
         if "userinfo" in _cntxt.cdb[request["client_id"]]:
             self.config["policy"] = _cntxt.cdb[request["client_id"]]["userinfo"]["policy"]
diff --git a/src/idpyoidc/server/session/database.py b/src/idpyoidc/server/session/database.py
index 7073c839..a886143f 100644
--- a/src/idpyoidc/server/session/database.py
+++ b/src/idpyoidc/server/session/database.py
@@ -18,6 +18,7 @@
 
 from .grant import Grant
 from .info import NodeInfo
+from ...util import instantiate
 
 logger = logging.getLogger(__name__)
 
@@ -184,5 +185,6 @@ def flush(self):
         self.db = DLDict()
 
     def local_load_adjustments(self, **kwargs):
-        _crypt = init_encrypter(self.crypt_config)
-        self.crypt = _crypt["encrypter"]
+        self.crypt = instantiate(self.crypt_config["class"], **self.crypt_config["kwargs"])
+        # _crypt = init_encrypter(self.crypt_config)
+        # self.crypt = _crypt["encrypter"]
diff --git a/src/idpyoidc/server/token/handler.py b/src/idpyoidc/server/token/handler.py
index 92752ccb..8fa90631 100755
--- a/src/idpyoidc/server/token/handler.py
+++ b/src/idpyoidc/server/token/handler.py
@@ -148,6 +148,7 @@ def factory(
     refresh: Optional[dict] = None,
     id_token: Optional[dict] = None,
     jwks_file: Optional[str] = "",
+    jwks_def: Optional[dict] = None,
     **kwargs
 ) -> TokenHandler:
     """
@@ -167,15 +168,15 @@ def factory(
         "idtoken": "id_token",
     }
 
-    key_defs = []
     read_only = False
     cwd = upstream_get("attribute", "cwd")
-    if kwargs.get("jwks_def"):
-        defs = kwargs["jwks_def"]
+    if jwks_def:
         if not jwks_file:
-            jwks_file = defs.get("private_path", os.path.join(cwd, JWKS_FILE))
-        read_only = defs.get("read_only", read_only)
-        key_defs = defs.get("key_defs", [])
+            jwks_file = jwks_def.get("private_path", os.path.join(cwd, JWKS_FILE))
+        read_only = jwks_def.get("read_only", read_only)
+        key_defs = jwks_def.get("key_defs", [])
+    else:
+        key_defs = None
 
     # if not jwks_file:
     #     jwks_file = os.path.join(cwd, JWKS_FILE)
diff --git a/src/idpyoidc/server/util.py b/src/idpyoidc/server/util.py
index c18513e7..46b450a3 100755
--- a/src/idpyoidc/server/util.py
+++ b/src/idpyoidc/server/util.py
@@ -43,14 +43,11 @@ def build_endpoints(conf, upstream_get, issuer):
         else:
             _instance = spec["class"](upstream_get=upstream_get, **kwargs)
 
-        try:
-            _path = spec["path"]
-        except KeyError:
-            # Should there be a default ?
-            raise
-
-        _instance.endpoint_path = _path
-        _instance.full_path = "{}/{}".format(_url, _path)
+        _path = spec.get("path", "")
+
+        if _path:
+            _instance.endpoint_path = _path
+            _instance.full_path = "{}/{}".format(_url, _path)
 
         endpoint[_instance.name] = _instance
 
diff --git a/src/idpyoidc/storage/abfile.py b/src/idpyoidc/storage/abfile.py
index cb80182d..6257fe21 100644
--- a/src/idpyoidc/storage/abfile.py
+++ b/src/idpyoidc/storage/abfile.py
@@ -24,11 +24,11 @@ class AbstractFileSystem(DictType):
     """
 
     def __init__(
-        self,
-        fdir: Optional[str] = "",
-        key_conv: Optional[str] = "",
-        value_conv: Optional[str] = "",
-        **kwargs
+            self,
+            fdir: Optional[str] = "",
+            key_conv: Optional[str] = "",
+            value_conv: Optional[str] = "",
+            **kwargs
     ):
         """
         items = FileSystem(
@@ -86,11 +86,12 @@ def __getitem__(self, item):
         item = self.key_conv.serialize(item)
 
         if self.is_changed(item):
-            logger.info("File content change in {}".format(item))
+            logger.info(f"File content change in {item}")
             fname = os.path.join(self.fdir, item)
             self.storage[item] = self._read_info(fname)
 
-        logger.debug('Read from "%s"', item)
+        _msg = f'Read from "{item}"'
+        logger.debug(_msg)
         # storage values are already value converted
         return self.storage[item]
 
@@ -114,21 +115,27 @@ def __setitem__(self, key, value):
             _key = key
 
         fname = os.path.join(self.fdir, _key)
-        lock = FileLock("{}.lock".format(fname))
+        lock = FileLock(f"{fname}.lock")
         with lock:
             with open(fname, "w") as fp:
                 fp.write(self.value_conv.serialize(value))
 
         self.storage[_key] = value
-        logger.debug('Wrote to "%s"', key)
+        _msg = f'Wrote to "{key}"'
+        logger.debug(_msg)
         self.fmtime[_key] = self.get_mtime(fname)
 
     def __delitem__(self, key):
         fname = os.path.join(self.fdir, key)
-        if os.path.isfile(fname):
-            lock = FileLock("{}.lock".format(fname))
-            with lock:
+        if fname.endswith(".lock"):
+            if os.path.isfile(fname):
                 os.unlink(fname)
+        else:
+            if os.path.isfile(fname):
+                lock = FileLock(f"{fname}.lock")
+                with lock:
+                    os.unlink(fname)
+                    os.unlink(f"{fname}.lock")
 
         try:
             del self.storage[key]
@@ -190,15 +197,17 @@ def is_changed(self, item):
     def _read_info(self, fname):
         if os.path.isfile(fname):
             try:
-                lock = FileLock("{}.lock".format(fname))
+                lock = FileLock(f"{fname}.lock")
                 with lock:
                     info = open(fname, "r").read().strip()
+                lock.release()
                 return self.value_conv.deserialize(info)
             except Exception as err:
                 logger.error(err)
                 raise
         else:
-            logger.error("No such file: {}".format(fname))
+            _msg = f"No such file: '{fname}'"
+            logger.error(_msg)
         return None
 
     def synch(self):
@@ -225,7 +234,8 @@ def synch(self):
                 try:
                     self.storage[f] = self._read_info(fname)
                 except Exception as err:
-                    logger.warning("Bad content in {} ({})".format(fname, err))
+                    _msg = f"Bad content in {fname} ({err})"
+                    logger.warning(_msg)
                 else:
                     self.fmtime[f] = mtime
 
@@ -287,7 +297,7 @@ def __len__(self):
         return n
 
     def __str__(self):
-        return "{config:" + str(self.config) + ", info:" + str(self.storage) + "}"
+        return f"info:{self.storage}"
 
     def dump(self):
         return {k: v for k, v in self.items()}
diff --git a/src/idpyoidc/util.py b/src/idpyoidc/util.py
index 21c66afa..0d8d3424 100644
--- a/src/idpyoidc/util.py
+++ b/src/idpyoidc/util.py
@@ -1,3 +1,4 @@
+import base64
 import importlib
 import json
 import logging
@@ -11,8 +12,8 @@
 from urllib.parse import urlsplit
 from urllib.parse import urlunsplit
 
-import yaml
 from cryptojwt.utils import importer
+import yaml
 
 logger = logging.getLogger(__name__)
 
@@ -107,6 +108,16 @@ def deserialize(self, str):
         return str
 
 
+class Base64(object):
+    @staticmethod
+    def serialize(str):
+        return base64.b64encode(str.encode("utf-8")).decode("utf-8")
+
+    @staticmethod
+    def deserialize(str):
+        return base64.b64decode(str.encode("utf-8")).decode("utf-8")
+
+
 def get_http_params(config):
     params = config.get("httpc_params", {})
 
diff --git a/tests/private/token_jwks.json b/tests/private/token_jwks.json
index 105acf1b..96348945 100644
--- a/tests/private/token_jwks.json
+++ b/tests/private/token_jwks.json
@@ -1 +1 @@
-{"keys": [{"kty": "oct", "use": "enc", "kid": "code", "k": "vSHDkLBHhDStkR0NWu8519rmV5zmnm5_"}, {"kty": "oct", "use": "enc", "kid": "refresh", "k": "GupTpe3QRVG7tC6UFJShLi3i9L8gznvU"}]}
\ No newline at end of file
+{"keys": [{"kty": "oct", "use": "enc", "kid": "code", "k": "vSHDkLBHhDStkR0NWu8519rmV5zmnm5_"}, {"kty": "oct", "use": "enc", "kid": "refresh", "k": "XB2_T04TbhR_hmpm439FntWuuidEDy-H"}]}
\ No newline at end of file
diff --git a/tests/pub_client.jwks b/tests/pub_client.jwks
index d5ce25ed..84a27042 100644
--- a/tests/pub_client.jwks
+++ b/tests/pub_client.jwks
@@ -1 +1 @@
-{"keys": [{"kty": "EC", "use": "sig", "kid": "azZQQ2FEQjh3QnVZWVdrbHJkMEZSaWR6aVJ0LTBjeUFfeWRlbTRrRFZ5VQ", "crv": "P-256", "x": "2ADe18caWWGp6hpRbfa9HqQHDFNpid9xUmR56Wzm_wc", "y": "HnD_8QBanz4Y-UF8mKQFZXfqkGkXUSm34mLsdDKtSyk"}, {"kty": "RSA", "use": "sig", "kid": "SHEyYWcwNVk0LTdROTZzZ2FUWndIVXdack0xWUM5SEpwcS03dVUxWU4zRQ", "n": "rRz52ddyP9Y2ezSlRsnkt-sjXfV_Ii7vOFX-cStLE3IUlVeSJGEe_kAASLr2r3BE2unjntaxj67NP8D95h_rzG1SpCklTEn-aTe3FOwNyTzUH_oiDVeRoEcf04Y43ciRGYRB5PhI6ii-2lYuig6hyUr776Qxiu6-0zw-M_ay2MgGSy5CEj55dDSvcUyxStUObxGpPWnEvybO1vnE7iJEWGNe0L5uPe5nLidOiR-JwjxSWEx1xZYtIjxaf2Ulu-qu4hwgwBUQdx4bNZyBfljKj55skWuHqPMG3xMjnedQC6Ms5bR3rIkbBpvmgI3kJK-4CZikM6ruyLo94-Lk19aYQw", "e": "AQAB"}]}
\ No newline at end of file
+{"keys": [{"kty": "EC", "use": "sig", "kid": "azZQQ2FEQjh3QnVZWVdrbHJkMEZSaWR6aVJ0LTBjeUFfeWRlbTRrRFZ5VQ", "crv": "P-256", "x": "2ADe18caWWGp6hpRbfa9HqQHDFNpid9xUmR56Wzm_wc", "y": "HnD_8QBanz4Y-UF8mKQFZXfqkGkXUSm34mLsdDKtSyk"}, {"kty": "RSA", "use": "sig", "kid": "SHEyYWcwNVk0LTdROTZzZ2FUWndIVXdack0xWUM5SEpwcS03dVUxWU4zRQ", "e": "AQAB", "n": "rRz52ddyP9Y2ezSlRsnkt-sjXfV_Ii7vOFX-cStLE3IUlVeSJGEe_kAASLr2r3BE2unjntaxj67NP8D95h_rzG1SpCklTEn-aTe3FOwNyTzUH_oiDVeRoEcf04Y43ciRGYRB5PhI6ii-2lYuig6hyUr776Qxiu6-0zw-M_ay2MgGSy5CEj55dDSvcUyxStUObxGpPWnEvybO1vnE7iJEWGNe0L5uPe5nLidOiR-JwjxSWEx1xZYtIjxaf2Ulu-qu4hwgwBUQdx4bNZyBfljKj55skWuHqPMG3xMjnedQC6Ms5bR3rIkbBpvmgI3kJK-4CZikM6ruyLo94-Lk19aYQw"}]}
\ No newline at end of file
diff --git a/tests/pub_iss.jwks b/tests/pub_iss.jwks
index 77081f40..9b062907 100644
--- a/tests/pub_iss.jwks
+++ b/tests/pub_iss.jwks
@@ -1 +1 @@
-{"keys": [{"kty": "EC", "use": "sig", "kid": "SmdKMlVGcG1zMnprdDdXZGpGWEczdHhlZVpGbkx1THpPdUY4d0w4bnZkSQ", "crv": "P-256", "x": "tRHJYm0fsOi0icpGEb33qiDVgt68ltMoYSWdLGhDGz4", "y": "fRpX0i6p5Jigf5I0qwW34PyStosMShwWAWS8x_w5o7E"}, {"kty": "RSA", "use": "sig", "kid": "R0FsaFdqREFaUFp1c0MwbUpsbHVSZ200blBJZWJVMTUtNGsyVlBmdHk5UQ", "n": "2ilgsKVqF92KfhwmosSVeZOaDgb3RF1mbg-pqkmLO6YpOO06LF4V4angF-GhP-ysAm2E75aSIU4tnHVThFlcxTgKFqjYKJQXyVzTVK2r-L2IbvFPaDtvoU6WteybpMlIUVk2po3cFDGObCWYKCm7CUOLlwH0uOpui66P9VSCqdKVKbJRAQBvTSbP10KWPxulfqjWGJtHO5fY7-JVWwOBkG-eHSJIT_uaoPjyvKCZjknq04bLUV9qP78KRQpRyYijBN60w2v8F79baN9CN10TIEjjWKGz0uX0M_YYQzTUoSY5l5ka9RkL3wT4o2iQ1t5nHphX6aA-gqwgCQmi-nvjaw", "e": "AQAB"}]}
\ No newline at end of file
+{"keys": [{"kty": "EC", "use": "sig", "kid": "SmdKMlVGcG1zMnprdDdXZGpGWEczdHhlZVpGbkx1THpPdUY4d0w4bnZkSQ", "crv": "P-256", "x": "tRHJYm0fsOi0icpGEb33qiDVgt68ltMoYSWdLGhDGz4", "y": "fRpX0i6p5Jigf5I0qwW34PyStosMShwWAWS8x_w5o7E"}, {"kty": "RSA", "use": "sig", "kid": "R0FsaFdqREFaUFp1c0MwbUpsbHVSZ200blBJZWJVMTUtNGsyVlBmdHk5UQ", "e": "AQAB", "n": "2ilgsKVqF92KfhwmosSVeZOaDgb3RF1mbg-pqkmLO6YpOO06LF4V4angF-GhP-ysAm2E75aSIU4tnHVThFlcxTgKFqjYKJQXyVzTVK2r-L2IbvFPaDtvoU6WteybpMlIUVk2po3cFDGObCWYKCm7CUOLlwH0uOpui66P9VSCqdKVKbJRAQBvTSbP10KWPxulfqjWGJtHO5fY7-JVWwOBkG-eHSJIT_uaoPjyvKCZjknq04bLUV9qP78KRQpRyYijBN60w2v8F79baN9CN10TIEjjWKGz0uX0M_YYQzTUoSY5l5ka9RkL3wT4o2iQ1t5nHphX6aA-gqwgCQmi-nvjaw"}]}
\ No newline at end of file
diff --git a/tests/test_client_29_pushed_auth.py b/tests/test_client_29_pushed_auth.py
index 995fa17c..02734cf7 100644
--- a/tests/test_client_29_pushed_auth.py
+++ b/tests/test_client_29_pushed_auth.py
@@ -57,7 +57,7 @@ def test_authorization(self):
         with responses.RequestsMock() as rsps:
             _resp = {"request_uri": "urn:example:bwc4JK-ESC0w8acc191e-Y1LTC2", "expires_in": 3600}
             rsps.add(
-                "GET",
+                "POST",
                 auth_service.upstream_get("context").provider_info[
                     "pushed_authorization_request_endpoint"
                 ],
diff --git a/tests/test_client_30_rph_defaults.py b/tests/test_client_30_rph_defaults.py
index 0b6af004..7d380462 100644
--- a/tests/test_client_30_rph_defaults.py
+++ b/tests/test_client_30_rph_defaults.py
@@ -52,7 +52,7 @@ def test_init_client(self):
         _keyjar = client.get_attribute("keyjar")
         assert list(_keyjar.owners()) == ["", BASE_URL]
         keys = _keyjar.get_issuer_keys("")
-        assert len(keys) == 4
+        assert len(keys) == 2
 
         assert _context.base_url == BASE_URL
 
diff --git a/tests/test_server_20d_client_authn.py b/tests/test_server_20d_client_authn.py
index 187414ac..d45e342b 100755
--- a/tests/test_server_20d_client_authn.py
+++ b/tests/test_server_20d_client_authn.py
@@ -358,7 +358,7 @@ def test_jws_authn_method_aud_token_endpoint(self):
     def test_jws_authn_method_aud_not_me(self):
         client_keyjar = KeyJar()
         client_keyjar.import_jwks(KEYJAR.export_jwks(private=True), CONF["issuer"])
-        # The only own key the client has a this point
+        # The only own key the client has at this point
         client_keyjar.add_symmetric("", client_secret, ["sig"])
 
         _jwt = JWT(client_keyjar, iss=client_id, sign_alg="HS256")
diff --git a/tests/test_server_50_persistence.py b/tests/test_server_50_persistence.py
index d28d112d..3ef3dcc4 100644
--- a/tests/test_server_50_persistence.py
+++ b/tests/test_server_50_persistence.py
@@ -66,6 +66,22 @@
     client_secret="hemligt",
 )
 
+AUTH_REQ_2 = AuthorizationRequest(
+    client_id="client_2",
+    redirect_uri="https://two.example.com/cb",
+    scope=["openid"],
+    state="STATE",
+    response_type="code",
+)
+
+TOKEN_REQ_2 = AccessTokenRequest(
+    client_id="client_2",
+    redirect_uri="https://two.example.com/cb",
+    state="STATE",
+    grant_type="authorization_code",
+    client_secret="hemligt",
+)
+
 TOKEN_REQ_DICT = TOKEN_REQ.to_dict()
 
 BASEDIR = os.path.abspath(os.path.dirname(__file__))
@@ -221,21 +237,39 @@ def create_endpoint(self):
         )
         # The top most part (Server class instance) is not
 
-        server1.context.cdb["client_1"] = {
-            "client_secret": "hemligt",
-            "redirect_uris": [("https://example.com/cb", None)],
-            "client_salt": "salted",
-            "token_endpoint_auth_method": "client_secret_post",
-            "response_types": ["code", "token", "code id_token", "id_token"],
-            "allowed_scopes": [
-                "openid",
-                "profile",
-                "email",
-                "address",
-                "phone",
-                "offline_access",
-                "research_and_scholarship",
-            ],
+        server1.context.cdb = {
+            "client_1": {
+                "client_secret": "hemligt",
+                "redirect_uris": [("https://example.com/cb", None)],
+                "client_salt": "salted",
+                "token_endpoint_auth_method": "client_secret_post",
+                "response_types": ["code", "token", "code id_token", "id_token"],
+                "allowed_scopes": [
+                    "openid",
+                    "profile",
+                    "email",
+                    "address",
+                    "phone",
+                    "offline_access",
+                    "research_and_scholarship",
+                ],
+            },
+            "client_2": {
+                "client_secret": "hemligt_ord",
+                "redirect_uris": [("https://two.example.com/cb", None)],
+                "client_salt": "salted peanuts",
+                "token_endpoint_auth_method": "client_secret_post",
+                "response_types": ["code", "code id_token", "id_token"],
+                "allowed_scopes": [
+                    "openid",
+                    "profile",
+                    "email",
+                    "address",
+                    "phone",
+                    "offline_access",
+                    "research_and_scholarship",
+                ]
+            }
         }
 
         # make server2 endpoint context a copy of server 1 endpoint context
@@ -315,8 +349,9 @@ def test_init(self):
             "openid"
         }
         assert (
-            self.endpoint[1].upstream_get("context").provider_info["claims_parameter_supported"]
-            == self.endpoint[2].upstream_get("context").provider_info["claims_parameter_supported"]
+                self.endpoint[1].upstream_get("context").provider_info["claims_parameter_supported"]
+                == self.endpoint[2].upstream_get("context").provider_info[
+                    "claims_parameter_supported"]
         )
 
     def test_parse(self):
@@ -474,7 +509,7 @@ def test_sman_db_integrity(self):
         sman = self.session_manager[1]
         session_dump = sman.dump()
 
-        # there after an exception a database could be inconsistent
+        # after an exception a database could be inconsistent
         # it would be better to always flush database when a new http request come
         # and load session from previously loaded sessions
         sman.flush()
@@ -499,7 +534,66 @@ def test_sman_db_integrity(self):
         # some mess before doing that
         sman.crypt_config = {"password": "ingoalla", "salt": "fantozzi"}
 
-        # ok, end of the games, session have been loaded and all the things be finally there!
+        # ok, end of the game, session have been loaded and all the things should finally be there!
         sman.load(session_dump)
         for i in "db", "crypt_config":
             assert session_dump[i] == sman.dump()[i]
+
+    def _get_client_session_info(self, client_id, db):
+        res = {}
+        for key, info in db.items():
+            val = self.session_manager[1].unpack_branch_key(key)
+            if len(val) > 1 and val[1] == client_id:
+                res[key] = info
+                if val[0] not in res:
+                    res[val[0]] = db[val[0]]
+
+        return res
+
+    def test_multiple_sessions(self):
+        session_id = self._create_session(AUTH_REQ, index=1)
+        grant = self.endpoint[1].upstream_get("context").authz(session_id, AUTH_REQ)
+        code = self._mint_code(grant, session_id, index=1)
+        access_token_1 = self._mint_access_token(grant, session_id, code, 1)
+
+        session_id = self._create_session(AUTH_REQ_2, index=1)
+        grant = self.endpoint[1].upstream_get("context").authz(session_id, AUTH_REQ_2)
+        code = self._mint_code(grant, session_id, index=1)
+        access_token_2 = self._mint_access_token(grant, session_id, code, 1)
+
+        _session_state = self.session_manager[1].dump()
+        _orig_db = _session_state["db"]
+        _client_1_db = self._get_client_session_info('client_1', _orig_db)
+        _session_state["db"] = _client_1_db
+
+        self.session_manager[2].load(
+            _session_state, init_args={"upstream_get": self.endpoint[2].upstream_get}
+        )
+
+        http_info = {"headers": {"authorization": "Bearer {}".format(access_token_1.value)}}
+        _req = self.endpoint[2].parse_request({}, http_info=http_info)
+        args = self.endpoint[2].process_request(_req)
+        assert args["client_id"] == "client_1"
+
+        # this should not work
+
+        http_info = {"headers": {"authorization": "Bearer {}".format(access_token_2.value)}}
+        _req = self.endpoint[2].parse_request({}, http_info=http_info)
+
+        assert _req["error"] == "invalid_token"
+
+        _token_info = self.session_manager[1].token_handler.info(access_token_2.value)
+        sid = _token_info.get("sid")
+        _path = self.session_manager[1].decrypt_branch_id(sid)
+
+        _client_db = self._get_client_session_info(_path[1], _orig_db)
+        _session_state["db"] = _client_db
+
+        self.session_manager[2].load(
+            _session_state, init_args={"upstream_get": self.endpoint[2].upstream_get}
+        )
+
+        http_info = {"headers": {"authorization": "Bearer {}".format(access_token_2.value)}}
+        _req = self.endpoint[2].parse_request({}, http_info=http_info)
+        args = self.endpoint[2].process_request(_req)
+        assert args["client_id"] == "client_2"