diff --git a/.git-hooks/commit-msg b/.git-hooks/commit-msg
index 750c5bb1..5d160e67 100755
--- a/.git-hooks/commit-msg
+++ b/.git-hooks/commit-msg
@@ -16,33 +16,39 @@ begin
   # Is the first character a GitMoji?
   gitmoji_index = full_text =~ Gitmoji::Regex::REGEX
   if gitmoji_index == 0
-    exit 0
+    exit(0)
   else
-    denied = <<EOM
-Oh snap, think again...
-
- ______    _______      ___  _______  _______  _______  _______  ______   __
-|    _ |  |       |    |   ||       ||       ||       ||       ||      | |  |
-|   | ||  |    ___|    |   ||    ___||       ||_     _||    ___||  _    ||  |
-|   |_||_ |   |___     |   ||   |___ |       |  |   |  |   |___ | | |   ||  |
-|    __  ||    ___| ___|   ||    ___||      _|  |   |  |    ___|| |_|   ||__|
-|   |  | ||   |___ |       ||   |___ |     |_   |   |  |   |___ |       | __
-|___|  |_||_______||_______||_______||_______|  |___|  |_______||______| |__|
-
-
-Did you forget to add a relevant gitmoji? (see https://gitmoji.dev/ for tools)
-In this project, a Gitmoji must be the first grapheme of the commit message.
-What's a grapheme?
-A symbol rendered to be visually identifiable as a single character, but which may be composed of multiple Unicode code points)
-Must match: #{Gitmoji::Regex::REGEX.to_s}
-#{gitmoji_index ? "Found a gitmoji at character index #{gitmoji_index}... not good enough.\n" : ""}
-Example: git commit -m "✨ My excellent new feature"
-
-EOM
+    denied = <<~EOM
+      Oh snap, think again...
+      
+       ______    _______      ___  _______  _______  _______  _______  ______   __
+      |    _ |  |       |    |   ||       ||       ||       ||       ||      | |  |
+      |   | ||  |    ___|    |   ||    ___||       ||_     _||    ___||  _    ||  |
+      |   |_||_ |   |___     |   ||   |___ |       |  |   |  |   |___ | | |   ||  |
+      |    __  ||    ___| ___|   ||    ___||      _|  |   |  |    ___|| |_|   ||__|
+      |   |  | ||   |___ |       ||   |___ |     |_   |   |  |   |___ |       | __
+      |___|  |_||_______||_______||_______||_______|  |___|  |_______||______| |__|
+      
+      
+      Did you forget to add a relevant gitmoji? (see https://gitmoji.dev/ for tools)
+      In this project, a Gitmoji must be the first grapheme of the commit message.
+      What's a grapheme?
+      A symbol rendered to be visually identifiable as a single character, but which may be composed of multiple Unicode code points)
+      Must match: #{Gitmoji::Regex::REGEX}
+      #{"Found a gitmoji at character index #{gitmoji_index}... not good enough.\n" if gitmoji_index}
+      Example: git commit -m "✨ My excellent new feature"
+      
+    EOM
     puts denied
-    exit 1
+    exit(1)
   end
 rescue LoadError => e
-  warn("gitmoji-regex gem not found: #{e.class}: #{e.message}.\n\tSkipping gitmoji check and allowing commit to proceed.\n\tRecommendation: add 'gitmoji-regex' to your development dependencies to enable this check.")
-  exit 0
+  failure = <<~EOM
+    gitmoji-regex gem not found: #{e.class}: #{e.message}.
+      Skipping gitmoji check and allowing commit to proceed.
+      Recommendation: add 'gitmoji-regex' to your development dependencies to enable this check.
+    
+  EOM
+  warn(failure)
+  exit(0)
 end
diff --git a/.git-hooks/footer-template.erb.txt b/.git-hooks/footer-template.erb.txt
index d732d699..36cdb0ad 100644
--- a/.git-hooks/footer-template.erb.txt
+++ b/.git-hooks/footer-template.erb.txt
@@ -1,5 +1,5 @@
 ⚡️ A message from a fellow meat-based-AI ⚡️
-- [❤️] Finely-crafted open-source tools like <%= @gem_name %> (& many more) are a full-time endeavor.
+- [❤️] Finely-crafted open-source tools like <%= @gem_name %> (& many more) require time and effort.
 - [❤️] Though I adore my work, it lacks financial sustainability.
 - [❤️] Please, help me continue enhancing your tools by becoming a sponsor:
   - [💲] https://liberapay.com/pboling/donate
diff --git a/.git-hooks/prepare-commit-msg b/.git-hooks/prepare-commit-msg
index c6a15570..dbc30589 100755
--- a/.git-hooks/prepare-commit-msg
+++ b/.git-hooks/prepare-commit-msg
@@ -3,17 +3,6 @@
 # Fail on error and unset variables
 set -eu
 
-# Determine project root as the parent directory of this hook script
-PROJECT_ROOT="$(CDPATH= cd -- "$(dirname -- "$0")"/.. && pwd)"
-
-# Run the Ruby hook within the direnv context (if available),
-# so ENV from .envrc/.env.local at project root is loaded.
-# One of the things .envrc needs to do is add $PROJECT_ROOT/bin/ to the path.
-# You should have this line at the top of .envrc
-#   PATH_add bin
-# NOTE: If this project ships exe scripts it should also add that.
-if command -v direnv >/dev/null 2>&1; then
-  exec direnv exec "$PROJECT_ROOT" "kettle-commit-msg" "$@"
-else
-  raise "direnv not found. Local development of this project ($PROJECT_ROOT) with tools from the kettle-dev gem may not work properly. Please run 'brew install direnv'."
-fi
+# We are not using direnv exec here because mise and direnv can result in conflicting PATH settings:
+# See: https://mise.jdx.dev/direnv.html
+exec "kettle-commit-msg" "$@"
diff --git a/.github/workflows/current.yml b/.github/workflows/current.yml
index f8a9e644..7dab87e0 100644
--- a/.github/workflows/current.yml
+++ b/.github/workflows/current.yml
@@ -63,11 +63,11 @@ jobs:
 
     steps:
       - name: Checkout
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         uses: actions/checkout@v5
 
       - name: Setup Ruby & RubyGems
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
@@ -79,11 +79,37 @@ jobs:
       # We need to do this first to get appraisal installed.
       # NOTE: This does not use the primary Gemfile at all.
       - name: Install Root Appraisal
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle
-      - name: Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+
+      - name: "[Attempt 1] Install Root Appraisal"
+        id: bundleAttempt1
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle
+        # Continue to the next step on failure
+        continue-on-error: true
+
+      # Effectively an automatic retry of the previous step.
+      - name: "[Attempt 2] Install Root Appraisal"
+        id: bundleAttempt2
+        # If bundleAttempt1 failed, try again here; Otherwise skip.
+        if: ${{ steps.bundleAttempt1.outcome == 'failure' && (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle
+
+      - name: "[Attempt 1] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
+        id: bundleAppraisalAttempt1
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle exec appraisal ${{ matrix.appraisal }} bundle
+        # Continue to the next step on failure
+        continue-on-error: true
+
+      # Effectively an automatic retry of the previous step.
+      - name: "[Attempt 2] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
+        id: bundleAppraisalAttempt2
+        # If bundleAppraisalAttempt1 failed, try again here; Otherwise skip.
+        if: ${{ steps.bundleAppraisalAttempt1.outcome == 'failure' && (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle
-      - name: Tests for ${{ matrix.ruby }}@${{ matrix.appraisal }} via ${{ matrix.exec_cmd }}
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+
+      - name: Tests for ${{ matrix.ruby }} via ${{ matrix.exec_cmd }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle exec ${{ matrix.exec_cmd }}
diff --git a/.github/workflows/dep-heads.yml b/.github/workflows/dep-heads.yml
index f6915689..a3d03f5f 100644
--- a/.github/workflows/dep-heads.yml
+++ b/.github/workflows/dep-heads.yml
@@ -47,9 +47,7 @@ jobs:
             rubygems: latest
             bundler: latest
 
-          # truffleruby-24.1
-          #   (according to documentation: targets Ruby 3.3 compatibility)
-          #   (according to runtime: targets Ruby 3.2 compatibility)
+          # truffleruby-24.1 (targets Ruby 3.3 compatibility)
           - ruby: "truffleruby"
             appraisal: "dep-heads"
             exec_cmd: "rake test"
@@ -67,11 +65,11 @@ jobs:
 
     steps:
       - name: Checkout
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         uses: actions/checkout@v5
 
       - name: Setup Ruby & RubyGems
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
@@ -82,24 +80,38 @@ jobs:
       # Raw `bundle` will use the BUNDLE_GEMFILE set to matrix.gemfile (i.e. Appraisal.root)
       # We need to do this first to get appraisal installed.
       # NOTE: This does not use the primary Gemfile at all.
-      - name: "Install Root Appraisal"
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+      - name: Install Root Appraisal
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle
 
-      - name: "[Attempt 1] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+      - name: "[Attempt 1] Install Root Appraisal"
         id: bundleAttempt1
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle
+        # Continue to the next step on failure
+        continue-on-error: true
+
+      # Effectively an automatic retry of the previous step.
+      - name: "[Attempt 2] Install Root Appraisal"
+        id: bundleAttempt2
+        # If bundleAttempt1 failed, try again here; Otherwise skip.
+        if: ${{ steps.bundleAttempt1.outcome == 'failure' && (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle
+
+      - name: "[Attempt 1] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
+        id: bundleAppraisalAttempt1
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle
         # Continue to the next step on failure
         continue-on-error: true
 
       # Effectively an automatic retry of the previous step.
       - name: "[Attempt 2] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
-        # If bundleAttempt1 failed, try again here; Otherwise skip.
-        if: ${{ steps.bundleAttempt1.outcome == 'failure' && !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
-        id: bundleAttempt2
+        id: bundleAppraisalAttempt2
+        # If bundleAppraisalAttempt1 failed, try again here; Otherwise skip.
+        if: ${{ steps.bundleAppraisalAttempt1.outcome == 'failure' && (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle
 
-      - name: Tests for ${{ matrix.ruby }}@${{ matrix.appraisal }} via ${{ matrix.exec_cmd }}
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+      - name: Tests for ${{ matrix.ruby }} via ${{ matrix.exec_cmd }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle exec ${{ matrix.exec_cmd }}
diff --git a/.github/workflows/heads.yml b/.github/workflows/heads.yml
index f8c92d16..104f1a7a 100644
--- a/.github/workflows/heads.yml
+++ b/.github/workflows/heads.yml
@@ -64,11 +64,11 @@ jobs:
 
     steps:
       - name: Checkout
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         uses: actions/checkout@v5
 
       - name: Setup Ruby & RubyGems
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
@@ -79,24 +79,38 @@ jobs:
       # Raw `bundle` will use the BUNDLE_GEMFILE set to matrix.gemfile (i.e. Appraisal.root)
       # We need to do this first to get appraisal installed.
       # NOTE: This does not use the primary Gemfile at all.
-      - name: "Install Root Appraisal"
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+      - name: Install Root Appraisal
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle
 
-      - name: "[Attempt 1] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+      - name: "[Attempt 1] Install Root Appraisal"
         id: bundleAttempt1
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle
+        # Continue to the next step on failure
+        continue-on-error: true
+
+      # Effectively an automatic retry of the previous step.
+      - name: "[Attempt 2] Install Root Appraisal"
+        id: bundleAttempt2
+        # If bundleAttempt1 failed, try again here; Otherwise skip.
+        if: ${{ steps.bundleAttempt1.outcome == 'failure' && (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
+        run: bundle
+
+      - name: "[Attempt 1] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
+        id: bundleAppraisalAttempt1
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle
         # Continue to the next step on failure
         continue-on-error: true
 
       # Effectively an automatic retry of the previous step.
       - name: "[Attempt 2] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
-        # If bundleAttempt1 failed, try again here; Otherwise skip.
-        if: ${{ steps.bundleAttempt1.outcome == 'failure' && !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
-        id: bundleAttempt2
+        id: bundleAppraisalAttempt2
+        # If bundleAppraisalAttempt1 failed, try again here; Otherwise skip.
+        if: ${{ steps.bundleAppraisalAttempt1.outcome == 'failure' && (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle
 
-      - name: Tests for ${{ matrix.ruby }}@${{ matrix.appraisal }} via ${{ matrix.exec_cmd }}
-        if: ${{ !(env.ACT && startsWith(matrix.ruby, 'jruby')) }}
+      - name: Tests for ${{ matrix.ruby }} via ${{ matrix.exec_cmd }}
+        if: ${{ (env.ACT && !(startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) || (!env.ACT && (startsWith(matrix.ruby, 'jruby')) || startsWith(matrix.ruby, 'truffleruby')) }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle exec ${{ matrix.exec_cmd }}
diff --git a/.github/workflows/legacy.yml b/.github/workflows/legacy.yml
index 7f1fc299..f7853f62 100644
--- a/.github/workflows/legacy.yml
+++ b/.github/workflows/legacy.yml
@@ -50,8 +50,8 @@ jobs:
             appraisal: "ruby-3-1"
             exec_cmd: "rake test"
             gemfile: "Appraisal.root"
-            rubygems: latest
-            bundler: latest
+            rubygems: '3.6.9'
+            bundler: '2.6.9'
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index 2fe1e03c..4fbef86e 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -63,3 +63,5 @@ jobs:
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle
       - name: Run ${{ matrix.appraisal }} checks via ${{ matrix.exec_cmd }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle exec ${{ matrix.exec_cmd }}
+      - name: Validate RBS Types
+        run: bundle exec appraisal ${{ matrix.appraisal }} bin/rbs validate
diff --git a/.github/workflows/truffle.yml b/.github/workflows/truffle.yml
deleted file mode 100644
index db651885..00000000
--- a/.github/workflows/truffle.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-name: Truffle
-
-permissions:
-  contents: read
-
-env:
-  K_SOUP_COV_DO: false
-
-on:
-  push:
-    branches:
-      - 'main'
-      - '*-stable'
-    tags:
-      - '!*' # Do not execute on tags
-  pull_request:
-    branches:
-      - '*'
-  # Allow manually triggering the workflow.
-  workflow_dispatch:
-
-# Cancels all previous workflow runs for the same branch that have not yet completed.
-concurrency:
-  # The concurrency group contains the workflow name and the branch name.
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: true
-
-jobs:
-  test:
-    if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')"
-    name: Specs ${{ matrix.ruby }} ${{ matrix.appraisal }}${{ matrix.name_extra || '' }}
-    runs-on: ubuntu-22.04
-    continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
-    env: # $BUNDLE_GEMFILE must be set at job level, so it is set for all steps
-      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile }}.gemfile
-    strategy:
-      matrix:
-        include:
-          # NOTE: truffleruby does not support upgrading rubygems.
-          # truffleruby-23.1 (targets Ruby 3.2 compatibility)
-          - ruby: "truffleruby-23.1"
-            appraisal: "ruby-3-2"
-            exec_cmd: "rake test"
-            gemfile: "Appraisal.root"
-            rubygems: default
-            bundler: default
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Setup Ruby & RubyGems
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby }}
-          rubygems: ${{ matrix.rubygems }}
-          bundler: ${{ matrix.bundler }}
-          bundler-cache: false
-
-      # Raw `bundle` will use the BUNDLE_GEMFILE set to matrix.gemfile (i.e. Appraisal.root)
-      # We need to do this first to get appraisal installed.
-      # NOTE: This does not use the primary Gemfile at all.
-      - name: Install Root Appraisal
-        run: bundle
-
-      - name: "[Attempt 1] Install Root Appraisal"
-        id: bundleAttempt1
-        run: bundle
-        # Continue to the next step on failure
-        continue-on-error: true
-
-      # Effectively an automatic retry of the previous step.
-      - name: "[Attempt 2] Install Root Appraisal"
-        id: bundleAttempt2
-        # If bundleAttempt1 failed, try again here; Otherwise skip.
-        if: steps.bundleAttempt1.outcome == 'failure'
-        run: bundle
-
-      - name: "[Attempt 1] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
-        id: bundleAppraisalAttempt1
-        run: bundle exec appraisal ${{ matrix.appraisal }} bundle
-        # Continue to the next step on failure
-        continue-on-error: true
-
-      # Effectively an automatic retry of the previous step.
-      - name: "[Attempt 2] Appraisal for ${{ matrix.ruby }}@${{ matrix.appraisal }}"
-        id: bundleAppraisalAttempt2
-        # If bundleAttempt1 failed, try again here; Otherwise skip.
-        if: steps.bundleAppraisalAttempt1.outcome == 'failure'
-        run: bundle exec appraisal ${{ matrix.appraisal }} bundle
-
-      - name: Tests for ${{ matrix.ruby }} via ${{ matrix.exec_cmd }}
-        run: bundle exec appraisal ${{ matrix.appraisal }} bundle exec ${{ matrix.exec_cmd }}
diff --git a/.gitignore b/.gitignore
index 15f1f941..068190dc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 *.gem
 
 # Bundler
+/vendor/bundle/
 /.bundle/
 /gemfiles/*.lock
 /gemfiles/.bundle/
diff --git a/.junie/guidelines.md b/.junie/guidelines.md
index 152e080b..42844a0a 100644
--- a/.junie/guidelines.md
+++ b/.junie/guidelines.md
@@ -47,9 +47,7 @@ This document captures project-specific knowledge to streamline setup, testing,
   - RSpec 3.13 with custom spec/spec_helper.rb configuration:
     - silent_stream: STDOUT is silenced by default for examples to keep logs clean.
       - To explicitly test console output, tag the example or group with :check_output.
-    - Global state hygiene: Around each example, FlossFunding.namespaces and FlossFunding.silenced are snapshotted and restored to prevent cross-test pollution.
     - DEBUG toggle: Set DEBUG=true to require 'debug' and avoid silencing output during your run.
-    - ENV seeding: The suite sets ENV["FLOSS_FUNDING_FLOSS_FUNDING"] = "Free-as-in-beer" so that the library’s own namespace is considered activated (avoids noisy warnings).
     - Coverage: kettle-soup-cover integrates SimpleCov; .simplecov is invoked from spec_helper when enabled by Kettle::Soup::Cover::DO_COV, which is controlled by K_SOUP_COV_DO being set to true / false.
     - RSpec.describe usage:
       - Use `describe "#<method_name>"` to contain a block of specs that test instance method behavior.
@@ -73,10 +71,11 @@ This document captures project-specific knowledge to streamline setup, testing,
   - Output visibility
     - To see STDOUT from the code under test, use the :check_output tag on the example or group.
       Example:
-      RSpec.describe "output", :check_output do
-        it "prints" do
-          puts "This output should be visible"
-          expect(true).to be true
+      RSpec.describe "with output", :check_output do
+        it "has output" do
+          output = capture(:stderr) {kernel.warn("This is a warning")}
+          logs = [ "This is a warning\n" ]
+          expect(output).to(include(*logs))
         end
       end
     - Alternatively, run with DEBUG=true to disable silencing for the entire run.
@@ -94,7 +93,9 @@ This document captures project-specific knowledge to streamline setup, testing,
       include_context 'with stubbed env'
     - in a before hook, or in an example:
       stub_env("FLOSS_FUNDING_MY_NS" => "Free-as-in-beer")
+
       # example code continues
+
   - If your spec needs to assert on console output, tag it with :check_output. By default, STDOUT is silenced.
   - Use Timecop for deterministic time-sensitive behavior as needed (require config/timecop is already done by spec_helper).
 
diff --git a/.rubocop_gradual.lock b/.rubocop_gradual.lock
index 9a28e666..ae390c31 100644
--- a/.rubocop_gradual.lock
+++ b/.rubocop_gradual.lock
@@ -6,7 +6,7 @@
   "lib/oauth2.rb:2435263975": [
     [73, 11, 7, "ThreadSafety/ClassInstanceVariable: Avoid class instance variables.", 651502127]
   ],
-  "lib/oauth2/access_token.rb:707681139": [
+  "lib/oauth2/access_token.rb:1962777363": [
     [64, 13, 5, "Style/IdenticalConditionalBranches: Move `t_key` out of the conditional.", 183811513],
     [70, 13, 5, "Style/IdenticalConditionalBranches: Move `t_key` out of the conditional.", 183811513]
   ],
diff --git a/.tool-versions b/.tool-versions
index d1de26c4..048c75ee 100755
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
 direnv 2.32.2
-ruby   3.4.5
+ruby   3.4.7
diff --git a/.yard_gfm_support.rb b/.yard_gfm_support.rb
deleted file mode 100644
index 4f2f1403..00000000
--- a/.yard_gfm_support.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-# Gratefully and liberally taken from the MIT-licensed https://github.com/bensheldon/good_job/pull/113/files
-require "kramdown"
-require "kramdown-parser-gfm"
-
-# Custom markup provider class that always renders Kramdown using GFM (Github Flavored Markdown).
-# GFM is needed to render markdown tables and fenced code blocks in the README.
-class KramdownGfmDocument < Kramdown::Document
-  def initialize(source, options = {})
-    options[:input] = "GFM" unless options.key?(:input)
-    super(source, options)
-  end
-end
-
-# Insert the new provider as the highest priority option for Markdown.
-# See:
-# - https://github.com/lsegal/yard/issues/1157
-# - https://github.com/lsegal/yard/issues/1017
-# - https://github.com/lsegal/yard/blob/main/lib/yard/templates/helpers/markup_helper.rb
-YARD::Templates::Helpers::MarkupHelper::MARKUP_PROVIDERS[:markdown].insert(
-  0,
-  {const: "KramdownGfmDocument"},
-)
diff --git a/.yardopts b/.yardopts
index 479134df..ab259161 100644
--- a/.yardopts
+++ b/.yardopts
@@ -1,11 +1,12 @@
+--plugin fence
+-e yard/fence/hoist.rb
 --plugin junk
 --plugin relative_markdown_links
---readme README.md
+--readme tmp/yard-fence/README.md
 --charset utf-8
 --markup markdown
 --output docs
---load .yard_gfm_support.rb
 'lib/**/*.rb'
 -
-'*.md'
-'*.txt'
\ No newline at end of file
+'tmp/yard-fence/*.md'
+'tmp/yard-fence/*.txt'
diff --git a/Appraisal.root.gemfile b/Appraisal.root.gemfile
index 02afd183..a0001cd0 100644
--- a/Appraisal.root.gemfile
+++ b/Appraisal.root.gemfile
@@ -2,7 +2,7 @@
 
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
-source "https://rubygems.org"
+source "https://gem.coop"
 
 # Appraisal Root Gemfile is for running appraisal to generate the Appraisal Gemfiles
 #   in gemfiles/*gemfile.
diff --git a/Appraisals b/Appraisals
index 90e5effc..5cacc191 100644
--- a/Appraisals
+++ b/Appraisals
@@ -47,66 +47,6 @@ appraise "dep-heads" do
   eval_gemfile "modular/runtime_heads.gemfile"
 end
 
-appraise "ruby-2-3-hashie_v0" do
-  eval_gemfile "modular/faraday_v0.gemfile"
-  eval_gemfile "modular/hashie_v0.gemfile"
-  eval_gemfile "modular/jwt_v1.gemfile"
-  eval_gemfile "modular/logger_v1_2.gemfile"
-  eval_gemfile "modular/multi_xml_v0_5.gemfile"
-  eval_gemfile "modular/rack_v1_2.gemfile"
-  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
-end
-
-appraise "ruby-2-3-hashie_v1" do
-  eval_gemfile "modular/faraday_v0.gemfile"
-  eval_gemfile "modular/hashie_v1.gemfile"
-  eval_gemfile "modular/jwt_v1.gemfile"
-  eval_gemfile "modular/logger_v1_2.gemfile"
-  eval_gemfile "modular/multi_xml_v0_5.gemfile"
-  eval_gemfile "modular/rack_v1_2.gemfile"
-  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
-end
-
-appraise "ruby-2-3-hashie_v2" do
-  eval_gemfile "modular/faraday_v0.gemfile"
-  eval_gemfile "modular/hashie_v2.gemfile"
-  eval_gemfile "modular/jwt_v1.gemfile"
-  eval_gemfile "modular/logger_v1_2.gemfile"
-  eval_gemfile "modular/multi_xml_v0_5.gemfile"
-  eval_gemfile "modular/rack_v1_2.gemfile"
-  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
-end
-
-appraise "ruby-2-3-hashie_v3" do
-  eval_gemfile "modular/faraday_v0.gemfile"
-  eval_gemfile "modular/hashie_v3.gemfile"
-  eval_gemfile "modular/jwt_v1.gemfile"
-  eval_gemfile "modular/logger_v1_2.gemfile"
-  eval_gemfile "modular/multi_xml_v0_5.gemfile"
-  eval_gemfile "modular/rack_v1_2.gemfile"
-  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
-end
-
-appraise "ruby-2-3-hashie_v4" do
-  eval_gemfile "modular/faraday_v0.gemfile"
-  eval_gemfile "modular/hashie_v4.gemfile"
-  eval_gemfile "modular/jwt_v1.gemfile"
-  eval_gemfile "modular/logger_v1_2.gemfile"
-  eval_gemfile "modular/multi_xml_v0_5.gemfile"
-  eval_gemfile "modular/rack_v1_2.gemfile"
-  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
-end
-
-appraise "ruby-2-3-hashie_v5" do
-  eval_gemfile "modular/faraday_v0.gemfile"
-  eval_gemfile "modular/hashie_v5.gemfile"
-  eval_gemfile "modular/jwt_v1.gemfile"
-  eval_gemfile "modular/logger_v1_2.gemfile"
-  eval_gemfile "modular/multi_xml_v0_5.gemfile"
-  eval_gemfile "modular/rack_v1_2.gemfile"
-  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
-end
-
 appraise "ruby-2-4" do
   eval_gemfile "modular/faraday_v1.gemfile"
   eval_gemfile "modular/hashie_v1.gemfile"
@@ -217,3 +157,63 @@ appraise "style" do
   eval_gemfile "modular/style.gemfile"
   eval_gemfile "modular/x_std_libs.gemfile"
 end
+
+appraise "ruby-2-3-hashie_v0" do
+  eval_gemfile "modular/faraday_v0.gemfile"
+  eval_gemfile "modular/hashie_v0.gemfile"
+  eval_gemfile "modular/jwt_v1.gemfile"
+  eval_gemfile "modular/logger_v1_2.gemfile"
+  eval_gemfile "modular/multi_xml_v0_5.gemfile"
+  eval_gemfile "modular/rack_v1_2.gemfile"
+  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
+end
+
+appraise "ruby-2-3-hashie_v1" do
+  eval_gemfile "modular/faraday_v0.gemfile"
+  eval_gemfile "modular/hashie_v1.gemfile"
+  eval_gemfile "modular/jwt_v1.gemfile"
+  eval_gemfile "modular/logger_v1_2.gemfile"
+  eval_gemfile "modular/multi_xml_v0_5.gemfile"
+  eval_gemfile "modular/rack_v1_2.gemfile"
+  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
+end
+
+appraise "ruby-2-3-hashie_v2" do
+  eval_gemfile "modular/faraday_v0.gemfile"
+  eval_gemfile "modular/hashie_v2.gemfile"
+  eval_gemfile "modular/jwt_v1.gemfile"
+  eval_gemfile "modular/logger_v1_2.gemfile"
+  eval_gemfile "modular/multi_xml_v0_5.gemfile"
+  eval_gemfile "modular/rack_v1_2.gemfile"
+  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
+end
+
+appraise "ruby-2-3-hashie_v3" do
+  eval_gemfile "modular/faraday_v0.gemfile"
+  eval_gemfile "modular/hashie_v3.gemfile"
+  eval_gemfile "modular/jwt_v1.gemfile"
+  eval_gemfile "modular/logger_v1_2.gemfile"
+  eval_gemfile "modular/multi_xml_v0_5.gemfile"
+  eval_gemfile "modular/rack_v1_2.gemfile"
+  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
+end
+
+appraise "ruby-2-3-hashie_v4" do
+  eval_gemfile "modular/faraday_v0.gemfile"
+  eval_gemfile "modular/hashie_v4.gemfile"
+  eval_gemfile "modular/jwt_v1.gemfile"
+  eval_gemfile "modular/logger_v1_2.gemfile"
+  eval_gemfile "modular/multi_xml_v0_5.gemfile"
+  eval_gemfile "modular/rack_v1_2.gemfile"
+  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
+end
+
+appraise "ruby-2-3-hashie_v5" do
+  eval_gemfile "modular/faraday_v0.gemfile"
+  eval_gemfile "modular/hashie_v5.gemfile"
+  eval_gemfile "modular/jwt_v1.gemfile"
+  eval_gemfile "modular/logger_v1_2.gemfile"
+  eval_gemfile "modular/multi_xml_v0_5.gemfile"
+  eval_gemfile "modular/rack_v1_2.gemfile"
+  eval_gemfile "modular/x_std_libs/r2.3/libs.gemfile"
+end
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 044437fe..17cc8fb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,11 +21,13 @@ Please file a bug if you notice a violation of semantic versioning.
 ### Added
 
 - [gh!683][gh!683], [gh!684][gh!684] - Improve documentation by @pboling
+- [gh!686][gh!686]- Add Incident Response Plan by @pboling
+- [gh!687][gh!687]- Add Threat Model by @pboling
 
 ### Changed
 
-- [gh!685][gh!685] - upgrade kettle-dev v1.1.24 by pboling
-- upgrade kettle-dev v1.1.26 by pboling
+- [gh!685][gh!685] - upgrade kettle-dev v1.1.24 by @pboling
+- upgrade kettle-dev v1.1.51 by @pboling
   - Add open collective donors to README
 
 ### Deprecated
@@ -34,11 +36,16 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Fixed
 
+- [gh!690][gh!690] - Add yard-fence to handle braces within code fences in markdown properly by @pboling
+
 ### Security
 
 [gh!683]: https://github.com/ruby-oauth/oauth2/pull/683
 [gh!684]: https://github.com/ruby-oauth/oauth2/pull/684
 [gh!685]: https://github.com/ruby-oauth/oauth2/pull/685
+[gh!686]: https://github.com/ruby-oauth/oauth2/pull/686
+[gh!687]: https://github.com/ruby-oauth/oauth2/pull/687
+[gh!690]: https://github.com/ruby-oauth/oauth2/pull/690
 
 ## [2.0.17] - 2025-09-15
 
@@ -49,7 +56,7 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Added
 
-- [gh!682][gh!682] - AccessToken: support Hash-based verb-dependent token transmission mode (e.g., {get: :query, post: :header})
+- [gh!682][gh!682] - AccessToken: support Hash-based verb-dependent token transmission mode (e.g., `{get: :query, post: :header}`)
 
 [gh!682]: https://github.com/ruby-oauth/oauth2/pull/682
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f70f8c81..fbc87e94 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,31 +24,22 @@ Follow these instructions:
 
 ## Executables vs Rake tasks
 
-Executables shipped by oauth2 can be used with or without generating the binstubs.
-They will work when oauth2 is installed globally (i.e., `gem install oauth2`) and do not require that oauth2 be in your bundle.
+Executables shipped by dependencies, such as kettle-dev, and stone_checksums, are available
+after running `bin/setup`. These include:
 
+- gem_checksums
 - kettle-changelog
 - kettle-commit-msg
-- oauth2-setup
+- kettle-dev-setup
 - kettle-dvcs
 - kettle-pre-release
 - kettle-readme-backers
 - kettle-release
 
-However, the rake tasks provided by oauth2 do require oauth2 to be added as a development dependency and loaded in your Rakefile.
-See the full list of rake tasks in head of Rakefile
+There are many Rake tasks available as well. You can see them by running:
 
-**Gemfile**
-```ruby
-group :development do
-  gem "oauth2", require: false
-end
-```
-
-**Rakefile**
-```ruby
-# Rakefile
-require "oauth2"
+```shell
+bin/rake -T
 ```
 
 ## Environment Variables for Local Development
@@ -77,7 +68,9 @@ GitHub API and CI helpers
 Releasing and signing
 - SKIP_GEM_SIGNING: If set, skip gem signing during build/release
 - GEM_CERT_USER: Username for selecting your public cert in `certs/<USER>.pem` (defaults to $USER)
-- SOURCE_DATE_EPOCH: Reproducible build timestamp. `kettle-release` will set this automatically for the session.
+- SOURCE_DATE_EPOCH: Reproducible build timestamp.
+  - `kettle-release` will set this automatically for the session.
+  - Not needed on bundler >= 2.7.0, as reproducible builds have become the default.
 
 Git hooks and commit message helpers (exe/kettle-commit-msg)
 - GIT_HOOK_BRANCH_VALIDATE: Branch name validation mode (e.g., `jira`) or `false` to disable
@@ -118,10 +111,8 @@ bundle exec rake test
 
 ### Spec organization (required)
 
-- One spec file per class/module. For each class or module under `lib/`, keep all of its unit tests in a single spec file under `spec/` that mirrors the path and file name exactly: `lib/oauth2/release_cli.rb` -> `spec/oauth2/release_cli_spec.rb`.
-- Never add a second spec file for the same class/module. Examples of disallowed names: `*_more_spec.rb`, `*_extra_spec.rb`, `*_status_spec.rb`, or any other suffix that still targets the same class. If you find yourself wanting a second file, merge those examples into the canonical spec file for that class/module.
+- One spec file per class/module. For each class or module under `lib/`, keep all of its unit tests in a single spec file under `spec/` that mirrors the path and file name exactly: `lib/oauth2/my_class.rb` -> `spec/oauth2/my_class_spec.rb`.
 - Exception: Integration specs that intentionally span multiple classes. Place these under `spec/integration/` (or a clearly named integration folder), and do not directly mirror a single class. Name them after the scenario, not a class.
-- Migration note: If a duplicate spec file exists, move all examples into the canonical file and delete the duplicate. Do not leave stubs or empty files behind.
 
 ## Lint It
 
@@ -144,7 +135,7 @@ For more detailed information about using RuboCop in this project, please see th
 Never add `# rubocop:disable ...` / `# rubocop:enable ...` comments to code or specs (except when following the few existing `rubocop:disable` patterns for a rule already being disabled elsewhere in the code). Instead:
 
 - Prefer configuration-based exclusions when a rule should not apply to certain paths or files (e.g., via `.rubocop.yml`).
-- When a violation is temporary and you plan to fix it later, record it in `.rubocop_gradual.lock` using the gradual workflow:
+- When a violation is temporary, and you plan to fix it later, record it in `.rubocop_gradual.lock` using the gradual workflow:
   - `bundle exec rake rubocop_gradual:autocorrect` (preferred)
   - `bundle exec rake rubocop_gradual:force_update` (only when you cannot fix the violations immediately)
 
@@ -167,7 +158,7 @@ Also see GitLab Contributors: [https://gitlab.com/ruby-oauth/oauth2/-/graphs/mai
 **IMPORTANT**: To sign a build,
 a public key for signing gems will need to be picked up by the line in the
 `gemspec` defining the `spec.cert_chain` (check the relevant ENV variables there).
-All releases to RubyGems.org are signed releases.
+All releases are signed releases.
 See: [RubyGems Security Guide][🔒️rubygems-security-guide]
 
 NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in the environment.
@@ -176,9 +167,10 @@ NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in th
 
 #### Automated process
 
-1. Update version.rb to contian the correct version-to-be-released.
+1. Update version.rb to contain the correct version-to-be-released.
 2. Run `bundle exec kettle-changelog`.
 3. Run `bundle exec kettle-release`.
+4. Stay awake and monitor the release process for any errors, and answer any prompts.
 
 #### Manual process
 
@@ -205,7 +197,7 @@ NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in th
 12. Sanity check the SHA256, comparing with the output from the `bin/gem_checksums` command:
     - `sha256sum pkg/<gem name>-<version>.gem`
 13. Run `bundle exec rake release` which will create a git tag for the version,
-    push git commits and tags, and push the `.gem` file to [rubygems.org][💎rubygems]
+    push git commits and tags, and push the `.gem` file to the gem host configured in the gemspec.
 
 [📜src-gl]: https://gitlab.com/ruby-oauth/oauth2/
 [📜src-cb]: https://codeberg.org/ruby-oauth/oauth2
@@ -216,7 +208,7 @@ NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in th
 [🖐contributors]: https://github.com/ruby-oauth/oauth2/graphs/contributors
 [🚎contributors-gl]: https://gitlab.com/ruby-oauth/oauth2/-/graphs/main
 [🖐contributors-img]: https://contrib.rocks/image?repo=ruby-oauth/oauth2
-[💎rubygems]: https://rubygems.org
+[💎gem-coop]: https://gem.coop
 [🔒️rubygems-security-guide]: https://guides.rubygems.org/security/#building-gems
 [🔒️rubygems-checksums-pr]: https://github.com/rubygems/rubygems/pull/6022
 [🔒️rubygems-guides-pr]: https://github.com/rubygems/guides/pull/325
diff --git a/FUNDING.md b/FUNDING.md
index b7a061d1..5ddd4bca 100644
--- a/FUNDING.md
+++ b/FUNDING.md
@@ -6,7 +6,7 @@ Many paths lead to being a sponsor or a backer of this project. Are you on such
 
 [![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal]
 
-[![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS or refugee efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS or refugee efforts using Patreon][🖇patreon-img]][🖇patreon]
+[![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS efforts using Patreon][🖇patreon-img]][🖇patreon]
 
 [⛳liberapay-img]: https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&color=a51611&style=flat
 [⛳liberapay]: https://liberapay.com/pboling/donate
@@ -31,11 +31,11 @@ Many paths lead to being a sponsor or a backer of this project. Are you on such
 
 <!-- RELEASE-NOTES-FOOTER-END -->
 
-# 🤑 Request for Help
+# 🤑 A request for help
 
 Maintainers have teeth and need to pay their dentists.
-After getting laid off in an RIF in March and filled with many dozens of rejections,
-I'm now spending ~60+ hours a week building open source tools.
+After getting laid off in an RIF in March, and encountering difficulty finding a new one,
+I began spending most of my time building open source tools.
 I'm hoping to be able to pay for my kids' health insurance this month,
 so if you value the work I am doing, I need your support.
 Please consider sponsoring me or the project.
@@ -44,16 +44,13 @@ To join the community or get help 👇️ Join the Discord.
 
 [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
 
-To say "thanks for maintaining such a great tool" ☝️ Join the Discord or 👇️ send money.
+To say "thanks!" ☝️ Join the Discord or 👇️ send money.
 
-[![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay-img] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal-img]
+[![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal]
 
 # Another Way to Support Open Source Software
 
-> How wonderful it is that nobody need wait a single moment before starting to improve the world.<br/>
->—Anne Frank
-
-I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions — totaling 79 hours of FLOSS coding over just the past seven days, a pretty regular week for me.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
+I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
 
 If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
 
diff --git a/Gemfile b/Gemfile
index 19875ab5..be6c1816 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-source "https://rubygems.org"
+source "https://gem.coop"
 
-git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
+git_source(:codeberg) { |repo_name| "https://codeberg.org/#{repo_name}" }
 git_source(:gitlab) { |repo_name| "https://gitlab.com/#{repo_name}" }
 
 #### IMPORTANT #######################################################
diff --git a/Gemfile.lock b/Gemfile.lock
index 5f2a158a..8c4b1f4b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,5 +1,5 @@
 GIT
-  remote: https://github.com/pboling/yard-junk
+  remote: https://github.com/pboling/yard-junk.git
   revision: 54ccebabbfa9a9cd44d0b991687ebbfd22c32b55
   branch: next
   specs:
@@ -23,7 +23,7 @@ PATH
       version_gem (~> 1.1, >= 1.1.9)
 
 GEM
-  remote: https://rubygems.org/
+  remote: https://gem.coop/
   specs:
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
@@ -33,18 +33,15 @@ GEM
       rake (>= 10)
       thor (>= 0.14)
     ast (2.4.3)
-    backports (3.25.1)
+    backports (3.25.2)
     base64 (0.3.0)
-    benchmark (0.4.1)
-    bigdecimal (3.2.3)
+    benchmark (0.5.0)
+    bigdecimal (3.3.1)
     bundler-audit (0.9.2)
       bundler (>= 1.2.0, < 3)
       thor (~> 1.0)
     concurrent-ruby (1.3.5)
-    crack (1.0.0)
-      bigdecimal
-      rexml
-    date (3.4.1)
+    date (3.5.0)
     debug (1.11.0)
       irb (~> 1.10)
       reline (>= 0.3.8)
@@ -81,29 +78,28 @@ GEM
       dry-inflector (~> 1.0)
       dry-logic (~> 1.4)
       zeitwerk (~> 2.6)
-    erb (5.0.2)
-    faraday (2.13.4)
+    erb (5.1.3)
+    faraday (2.14.0)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-net_http (3.4.1)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.4.2)
+      net-http (~> 0.5)
     gem_bench (2.0.5)
       bundler (>= 1.14)
       version_gem (~> 1.1, >= 1.1.4)
     gitmoji-regex (1.0.3)
       version_gem (~> 1.1, >= 1.1.8)
-    hashdiff (1.2.1)
     hashie (5.0.0)
     io-console (0.8.1)
-    irb (1.15.2)
+    irb (1.15.3)
       pp (>= 0.6.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.13.2)
+    json (2.16.0)
     jwt (3.1.2)
       base64
-    kettle-dev (1.1.31)
+    kettle-dev (1.1.51)
     kettle-soup-cover (1.0.10)
       simplecov (~> 0.22)
       simplecov-cobertura (~> 3.0)
@@ -113,15 +109,17 @@ GEM
       simplecov-rcov (~> 0.3, >= 0.3.7)
       simplecov_json_formatter (~> 0.1, >= 0.1.4)
       version_gem (~> 1.1, >= 1.1.8)
-    kettle-test (1.0.3)
+    kettle-test (1.0.6)
       appraisal2 (~> 3.0)
+      backports (~> 3.0)
       rspec (~> 3.0)
       rspec-block_is_expected (~> 1.0, >= 1.0.6)
+      rspec-pending_for (~> 0.1, >= 0.1.19)
       rspec-stubbed_env (~> 1.0, >= 1.0.4)
       rspec_junit_formatter (~> 0.6)
       silent_stream (~> 1.0, >= 1.0.12)
       timecop-rspec (~> 1.0, >= 1.0.3)
-      version_gem (~> 1.1, >= 1.1.8)
+      version_gem (~> 1.1, >= 1.1.9)
     kramdown (2.5.1)
       rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
@@ -132,33 +130,34 @@ GEM
     multi_xml (0.7.2)
       bigdecimal (~> 3.1)
     mutex_m (0.3.0)
-    net-http (0.6.0)
+    net-http (0.7.0)
       uri
     nkf (0.2.0)
     nokogiri (1.18.10-x86_64-linux-gnu)
       racc (~> 1.4)
     ostruct (0.6.3)
     parallel (1.27.0)
-    parser (3.3.9.0)
+    parser (3.3.10.0)
       ast (~> 2.4.1)
       racc
-    pp (0.6.2)
+    pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.5.1)
+    prism (1.6.0)
     psych (5.2.6)
       date
       stringio
     public_suffix (6.0.2)
     racc (1.8.1)
-    rack (3.2.1)
+    rack (3.2.4)
     rainbow (3.1.1)
-    rake (13.3.0)
+    rake (13.3.1)
     rbs (3.9.5)
       logger
-    rdoc (6.14.2)
+    rdoc (6.15.1)
       erb
       psych (>= 4.0.0)
+      tsort
     reek (6.5.0)
       dry-schema (~> 1.13)
       logger (~> 1.6)
@@ -171,17 +170,17 @@ GEM
     require_bench (1.0.4)
       version_gem (>= 1.1.3, < 4)
     rexml (3.4.4)
-    rspec (3.13.1)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
     rspec-block_is_expected (1.0.6)
-    rspec-core (3.13.5)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.5)
+    rspec-mocks (3.13.7)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-pending_for (0.1.19)
@@ -204,7 +203,7 @@ GEM
       rubocop-ast (>= 1.46.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.46.0)
+    rubocop-ast (1.47.1)
       parser (>= 3.3.7.2)
       prism (~> 1.4)
     rubocop-gradual (0.3.6)
@@ -245,7 +244,7 @@ GEM
       rubocop-thread_safety (~> 0.5, >= 0.5.1)
       standard-rubocop-lts (~> 1.0, >= 1.0.7)
       version_gem (>= 1.1.3, < 3)
-    rubocop-shopify (2.17.1)
+    rubocop-shopify (2.18.0)
       rubocop (~> 1.62)
     rubocop-thread_safety (0.7.3)
       lint_roller (~> 1.1)
@@ -294,8 +293,8 @@ GEM
       standard-custom (>= 1.0.2, < 2)
       standard-performance (>= 1.3.1, < 2)
       version_gem (>= 1.1.4, < 3)
-    stone_checksums (1.0.2)
-      version_gem (~> 1.1, >= 1.1.8)
+    stone_checksums (1.0.3)
+      version_gem (~> 1.1, >= 1.1.9)
     stringio (3.1.7)
     terminal-table (4.0.0)
       unicode-display_width (>= 1.1.1, < 4)
@@ -305,28 +304,27 @@ GEM
       delegate (~> 0.1)
       rspec (~> 3.0)
       timecop (>= 0.7, < 1)
+    tsort (0.2.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
     unicode-emoji (4.1.0)
-    uri (1.0.3)
-    vcr (6.3.1)
-      base64
+    uri (1.1.1)
     version_gem (1.1.9)
-    webmock (3.25.1)
-      addressable (>= 2.8.0)
-      crack (>= 0.3.2)
-      hashdiff (>= 0.4.0, < 2.0.0)
     yard (0.9.37)
+    yard-fence (0.5.0)
+      rdoc (~> 6.11)
+      version_gem (~> 1.1, >= 1.1.9)
+      yard (~> 0.9, >= 0.9.37)
     yard-relative_markdown_links (0.5.0)
       nokogiri (>= 1.14.3, < 2)
     zeitwerk (2.7.3)
-    zlib (3.2.1)
+    zlib (3.2.2)
 
 PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
-  addressable (~> 2.8, >= 2.8.7)
+  addressable (~> 2.8, >= 2.8.7, >= 2.8, < 3)
   appraisal2 (~> 3.0)
   backports (~> 3.25, >= 3.25.1)
   benchmark (~> 0.4, >= 0.4.1)
@@ -338,7 +336,7 @@ DEPENDENCIES
   irb (~> 1.15, >= 1.15.2)
   kettle-dev (~> 1.1)
   kettle-soup-cover (~> 1.0, >= 1.0.10)
-  kettle-test (~> 1.0)
+  kettle-test (~> 1.0, >= 1.0.6)
   kramdown (~> 2.5, >= 2.5.1)
   kramdown-parser-gfm (~> 1.1)
   mutex_m (~> 0.2)
@@ -349,7 +347,6 @@ DEPENDENCIES
   reek (~> 6.5)
   require_bench (~> 1.0, >= 1.0.4)
   rexml (~> 3.2, >= 3.2.5)
-  rspec-pending_for (~> 0.0, >= 0.0.17)
   rubocop-lts (~> 8.0)
   rubocop-on-rbs (~> 1.8)
   rubocop-packaging (~> 0.6, >= 0.6.0)
@@ -359,9 +356,8 @@ DEPENDENCIES
   standard (>= 1.50)
   stone_checksums (~> 1.0, >= 1.0.2)
   stringio (>= 3.0)
-  vcr (>= 4)
-  webmock (>= 3)
   yard (~> 0.9, >= 0.9.37)
+  yard-fence (~> 0.4)
   yard-junk (~> 0.0, >= 0.0.10)!
   yard-relative_markdown_links (~> 0.5.0)
 
diff --git a/OIDC.md b/OIDC.md
index 2bd7c708..22e31d11 100644
--- a/OIDC.md
+++ b/OIDC.md
@@ -16,11 +16,13 @@ If any other libraries would like to be added to this list, please open an issue
 This document complements the inline documentation by focusing on OpenID Connect (OIDC) 1.0 usage patterns when using this gem as an OAuth 2.0 client library.
 
 Scope of this document
+
 - Audience: Developers building an OAuth 2.0/OIDC Relying Party (RP, aka client) in Ruby.
 - Non-goals: This gem does not implement an OIDC Provider (OP, aka Authorization Server); for OP/server see other projects (e.g., doorkeeper + oidc extensions).
 - Status: Informational documentation with links to normative specs. The gem intentionally remains protocol-agnostic beyond OAuth 2.0; OIDC specifics (like ID Token validation) must be handled by your application.
 
 Key concepts refresher
+
 - OAuth 2.0 delegates authorization; it does not define authentication of the end-user.
 - OIDC layers an identity layer on top of OAuth 2.0, introducing:
   - ID Token: a JWT carrying claims about the authenticated end-user and the authentication event.
@@ -29,6 +31,7 @@ Key concepts refresher
   - Discovery and Dynamic Client Registration (optional for providers/clients that support them).
 
 What this gem provides for OIDC
+
 - All OAuth 2.0 client capabilities required for OIDC flows: building authorization requests, exchanging authorization codes, refreshing tokens, and making authenticated resource requests.
 - Transport and parsing conveniences (snaky hash, Faraday integration, error handling, etc.).
 - Optional client authentication schemes useful with OIDC deployments:
@@ -38,6 +41,7 @@ What this gem provides for OIDC
   - private_key_jwt (OIDC-compliant when configured per OP requirements)
 
 What you must add in your app for OIDC
+
 - ID Token validation: This gem surfaces id_token values but does not verify them. Your app should:
   1) Parse the JWT (header, payload, signature)
   2) Fetch the OP JSON Web Key Set (JWKS) from discovery (or configure statically)
@@ -124,10 +128,12 @@ userinfo = token.get("/userinfo").parsed
 ```
 
 Notes on discovery and registration
-- Discovery: Most OPs publish configuration at {issuer}/.well-known/openid-configuration (OIDC Discovery 1.0). From there, resolve authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, etc.
+
+- Discovery: Most OPs publish configuration at `{issuer}/.well-known/openid-configuration` (OIDC Discovery 1.0). From there, resolve authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, etc.
 - Dynamic Client Registration: Some OPs allow registering clients programmatically (OIDC Dynamic Client Registration 1.0). This gem does not implement registration; use a plain HTTP client or Faraday and store credentials securely.
 
 Common pitfalls and tips
+
 - Always request the openid scope when you expect an ID Token. Without it, the OP may behave as vanilla OAuth 2.0.
 - Validate ID Token signature and claims before trusting any identity data. Do not rely solely on the presence of an id_token field.
 - Prefer Authorization Code + PKCE. Avoid Implicit; it is discouraged in modern guidance and may be disabled by providers.
@@ -136,6 +142,7 @@ Common pitfalls and tips
 - When using private_key_jwt, ensure the "aud" (or token_url) and "iss/sub" claims are set per the OP’s rules, and include kid in the JWT header when required so the OP can select the right key.
 
 Relevant specifications and references
+
 - OpenID Connect Core 1.0: https://openid.net/specs/openid-connect-core-1_0.html
 - OIDC Core (final): https://openid.net/specs/openid-connect-core-1_0-final.html
 - How OIDC works: https://openid.net/developers/how-connect-works/
@@ -150,9 +157,11 @@ Relevant specifications and references
 - Spring Authorization Server’s list of OAuth2/OIDC specs: https://github.com/spring-projects/spring-authorization-server/wiki/OAuth2-and-OIDC-Specifications
 
 See also
+
 - README sections on OAuth 2.1 notes and OIDC notes
 - Strategy classes under lib/oauth2/strategy for flow helpers
 - Specs under spec/oauth2 for concrete usage patterns
 
 Contributions welcome
+
 - If you discover provider-specific nuances, consider contributing examples or clarifications (without embedding provider-specific hacks into the library).
diff --git a/README.md b/README.md
index 190f2420..13ab7ba0 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,32 @@
+| 📍 NOTE                                                                                                                                                           |
+|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| RubyGems (the [GitHub org][rubygems-org], not the website) [suffered][draper-security] a [hostile takeover][ellen-takeover] in September 2025.                    |
+| Ultimately [4 maintainers][simi-removed] were [hard removed][martin-removed] and a reason has been given for only 1 of those, while 2 others resigned in protest. |
+| It is a [complicated story][draper-takeover] which is difficult to [parse quickly][draper-lies].                                                                  |
+| I'm adding notes like this to gems because I [don't condone theft][draper-theft] of repositories or gems from their rightful owners.                              |
+| If a similar theft happened with my repos/gems, I'd hope some would stand up for me.                                                                              |
+| Disenfranchised former-maintainers have started [gem.coop][gem-coop].                                                                                             |
+| Once available I will publish there exclusively; unless RubyCentral makes amends with the community.                                                              |
+| The ["Technology for Humans: Joel Draper"][reinteractive-podcast] podcast episode by [reinteractive][reinteractive] is the most cogent summary I'm aware of.      |
+| See [here][gem-naming], [here][gem-coop] and [here][martin-ann] for more info on what comes next.                                                                 |
+| What I'm doing: A (WIP) proposal for [bundler/gem scopes][gem-scopes], and a (WIP) proposal for a federated [gem server][gem-server].                             |
+
+[rubygems-org]: https://github.com/rubygems/
+[draper-security]: https://joel.drapper.me/p/ruby-central-security-measures/
+[draper-takeover]: https://joel.drapper.me/p/ruby-central-takeover/
+[ellen-takeover]: https://pup-e.com/blog/goodbye-rubygems/
+[simi-removed]: https://www.reddit.com/r/ruby/s/gOk42POCaV
+[martin-removed]: https://bsky.app/profile/martinemde.com/post/3m3occezxxs2q
+[draper-lies]: https://joel.drapper.me/p/ruby-central-fact-check/
+[draper-theft]: https://joel.drapper.me/p/ruby-central/
+[reinteractive]: https://reinteractive.com/ruby-on-rails
+[gem-coop]: https://gem.coop
+[gem-naming]: https://github.com/gem-coop/gem.coop/issues/12
+[martin-ann]: https://martinemde.com/2025/10/05/announcing-gem-coop.html
+[gem-scopes]: https://github.com/galtzo-floss/bundle-namespace
+[gem-server]: https://github.com/galtzo-floss/gem-server
+[reinteractive-podcast]: https://youtu.be/_H4qbtC5qzU?si=BvuBU90R2wAqD2E6
+
 [![Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0][🖼️galtzo-i]][🖼️galtzo-discord] [![ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5][🖼️ruby-lang-i]][🖼️ruby-lang] [![oauth2 Logo by Chris Messina, CC BY-SA 3.0][🖼️oauth2-i]][🖼️oauth2]
 
 [🖼️galtzo-i]: https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg
@@ -30,7 +59,7 @@ This is a RubyGem for implementing OAuth 2.0 clients (not servers) in Ruby appli
 
 ### Quick Examples
 
-<details>
+<details markdown="1">
   <summary>Convert the following `curl` command into a token request using this gem...</summary>
 
 ```shell
@@ -61,7 +90,7 @@ NOTE: `header` - The content type specified in the `curl` is already the default
 
 </details>
 
-<details>
+<details markdown="1>
 <summary>Complete E2E single file script against mock-oauth2-server</summary>
 
 - E2E example uses [navikt/mock-oauth2-server](https://github.com/navikt/mock-oauth2-server), which was added in v2.0.11
@@ -110,6 +139,7 @@ Troubleshooting: validate connectivity to the mock server
     - `ss -ltnp | grep :8080`
 
 Notes
+
 - Discovery URL pattern is: `http://localhost:8080/<realm>/.well-known/openid-configuration`, where `<realm>` defaults to `default`.
 - You can change these with env vars when running the example:
     - `E2E_ISSUER_BASE` (default: http://localhost:8080)
@@ -129,107 +159,39 @@ If it seems like you are in the wrong place, you might try one of these:
 
 ## 💡 Info you can shake a stick at
 
-| Tokens to Remember      | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace]                                                                                                                                                                                                                                                                                                                                                                               |
-|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Works with JRuby        | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]                                                                                                                                                                                                               |
-| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf]                                                                                                                                                                                                                                                                 |
-| Works with MRI Ruby 3   | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]                                                                                                                                                                                              |
-| Works with MRI Ruby 2   | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf]                                                                                                                                                                                                   |
-| Support & Community     | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]                                                                                                                                            |
-| Source                  | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc]                                                                                                                                                                                                                                                              |
-| Documentation           | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki]                                                                                                                                                                                               |
-| Compliance              | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Incident Response Plan][🔐irp-img]][🔐irp] [![Security Policy][🔐security-img]][🔐security] [![Threat Model][🔐threat-model-img]][🔐threat-model]  [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
-| Style                   | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2]                                                                                                                                                                                                                       |
-| Maintainer 🎖️          | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto]                                                                                                                                                           |
-| `...` 💖                | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub]  [🛖][💖🛖hut] [🧪][💖🧪lab]                                                                                                                                                                        |
+| Tokens to Remember      | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace]                                                                                                                                                                                                                                                                          |
+|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Works with JRuby        | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]                                                                                                          |
+| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] ![Truffle Ruby 23.1 Compat][💎truby-23.1i] <br/> [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf]                                                                                                                                                                        |
+| Works with MRI Ruby 3   | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]                                                                                         |
+| Works with MRI Ruby 2   | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf]                                                                                              |
+| Support & Community     | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]                                       |
+| Source                  | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc]                                                                                                                                                         |
+| Documentation           | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki]                                                                                          |
+| Compliance              | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
+| Style                   | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2]                                                                                                                  |
+| Maintainer 🎖️          | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto]                                                      |
+| `...` 💖                | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub]  [🛖][💖🛖hut] [🧪][💖🧪lab]                                                                   |
 
 ### Compatibility
 
-* Operating Systems: Linux, macOS, Windows
-* MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
-    * NOTE: This gem may still _install_ and _run_ on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* JRuby @ v9.4, v10.0, HEAD
-    * NOTE: This gem may still _install_ and _run_ on JRuby v9.2 and v9.3, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* TruffleRuby @ v23.1, v24.1, HEAD
-    * NOTE: This gem may still _install_ and _run_ on Truffleruby v22.3 and v23.0, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* gem `faraday` @ v0, v1, v2, HEAD ⏩️ [lostisland/faraday](https://github.com/lostisland/faraday)
-* gem `jwt` @ v1, v2, v3, HEAD ⏩️ [jwt/ruby-jwt](https://github.com/jwt/ruby-jwt)
-* gem `logger` @ v1.2, v1.5, v1.7, HEAD ⏩️ [ruby/logger](https://github.com/ruby/logger)
-* gem `multi_xml` @ v0.5, v0.6, v0.7, HEAD ⏩️ [sferik/multi_xml](https://github.com/sferik/multi_xml)
-* gem `rack` @ v1.2, v1.6, v2, v3, HEAD ⏩️ [rack/rack](https://github.com/rack/rack)
-* gem `snaky_hash` @ v2, HEAD ⏩️ [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash)
-* gem `version_gem` @ v1, HEAD ⏩️ [ruby-oauth/version_gem](https://gitlab.com/ruby-oauth/version_gem)
-
-The last two were extracted from this gem. They are part of the `ruby-oauth` org,
-and are developed in tight collaboration with this gem.
-
-Also, where reasonable, tested against the runtime dependencies of those dependencies:
-
-* gem `hashie` @ v0, v1, v2, v3, v4, v5, HEAD ⏩️ [hashie/hashie](https://github.com/hashie/hashie)
-
-[GHA-continue-on-error-ui]: https://github.com/actions/runner/issues/2347#issuecomment-2653479732
-[GHA-allow-failure]: https://github.com/orgs/community/discussions/15452
-
-#### Upgrading Runtime Gem Dependencies
-
-This project sits underneath a large portion of the authorization systems on the internet.
-According to GitHub's project tracking, which I believe only reports on public projects,
-[100,000+ projects](https://github.com/ruby-oauth/oauth2/network/dependents), and
-[500+ packages](https://github.com/ruby-oauth/oauth2/network/dependents?dependent_type=PACKAGE) depend on this project.
-
-That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
-
-As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the
-leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
-
-What does that mean specifically for the runtime dependencies?
-
-We have 100% test coverage of lines and branches, and this test suite runs across a very large matrix.
-It wouldn't be possible without appraisal2.
+Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
 
 | 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚             |
 |------------------------------------------------|--------------------------------------------------------|
 | 👟 Check it out!                               | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
 
-#### You should upgrade this gem with confidence\*.
-
-- This gem follows a _strict & correct_ (according to the maintainer of SemVer; [more info][sv-pub-api]) interpretation of SemVer.
-    - Dropping support for **any** of the runtime dependency versions above will be a major version bump.
-    - If you aren't on one of the minor versions above, make getting there a priority.
-- You should upgrade the dependencies of this gem with confidence\*.
-- Please do upgrade, and then, when it goes smooth as butter [please sponsor me][🖇sponsor].  Thanks!
-
-[sv-pub-api]: #-versioning
-
-\* MIT license; The only guarantees I make are for [enterprise support](#enterprise-support).
-
-<details>
-  <summary>Standard Library Dependencies</summary>
-
-The various versions of each are tested via the Ruby test matrix, along with whatever Ruby includes them.
-
-* base64
-* cgi
-* json
-* time
-* logger (removed from stdlib in Ruby 3.5 so added as runtime dependency in v2.0.10)
-
-If you use a gem version of a core Ruby library, it should work fine!
-
-</details>
-
 ### Federated DVCS
 
-<details>
-  <summary>Find this repo on federated forges</summary>
+<details markdown="1">
+  <summary>Find this repo on federated forges (Coming soon!)</summary>
 
-| Federated [DVCS][💎d-in-dvcs] Repository      | Status                                                                | Issues                    | PRs                      | Wiki                      | CI                       | Discussions                  |
-|-----------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
-| 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl]    | The Truth                                                             | [💚][🤝gl-issues]         | [💚][🤝gl-pulls]         | [💚][📜gl-wiki]           | 🐭 Tiny Matrix           | ➖                            |
-| 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb]  | An Ethical Mirror ([Donate][🤝cb-donate])                             | [💚][🤝cb-issues]         | [💚][🤝cb-pulls]         | ➖                         | ⭕️ No Matrix             | ➖                            |
-| 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh]    | Another Mirror                                                        | [💚][🤝gh-issues]         | [💚][🤝gh-pulls]         | [💚][📜gh-wiki]           | 💯 Full Matrix           | [💚][gh-discussions]         |
-| 🤼 [OAuth Ruby Google Group][⛳gg-discussions] | "Active"                                                              | ➖                         | ➖                        | ➖                         | ➖                        | [💚][⛳gg-discussions]        |
-| 🎮️ [Discord Server][✉️discord-invite]        | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
+| Federated [DVCS][💎d-in-dvcs] Repository        | Status                                                                | Issues                    | PRs                      | Wiki                      | CI                       | Discussions                  |
+|-------------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
+| 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl]   | The Truth                                                             | [💚][🤝gl-issues]         | [💚][🤝gl-pulls]         | [💚][📜gl-wiki]           | 🐭 Tiny Matrix           | ➖                            |
+| 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate])                             | [💚][🤝cb-issues]         | [💚][🤝cb-pulls]         | ➖                         | ⭕️ No Matrix             | ➖                            |
+| 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh]   | Another Mirror                                                        | [💚][🤝gh-issues]         | [💚][🤝gh-pulls]         | [💚][📜gh-wiki]           | 💯 Full Matrix           | [💚][gh-discussions]         |
+| 🎮️ [Discord Server][✉️discord-invite]          | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
 
 </details>
 
@@ -239,7 +201,7 @@ If you use a gem version of a core Ruby library, it should work fine!
 
 Available as part of the Tidelift Subscription.
 
-<details>
+<details markdown="1">
   <summary>Need enterprise-level guarantees?</summary>
 
 The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
@@ -258,143 +220,6 @@ Alternatively:
 
 </details>
 
-## 🚀 Release Documentation
-
-### Version 2.0.x
-
-<details>
-  <summary>2.0.x CHANGELOG and README</summary>
-
-| Version | Release Date | CHANGELOG                             | README                          |
-|---------|--------------|---------------------------------------|---------------------------------|
-| 2.0.17  | 2025-09-15   | [v2.0.17 CHANGELOG][2.0.17-changelog] | [v2.0.17 README][2.0.17-readme] |
-| 2.0.16  | 2025-09-14   | [v2.0.16 CHANGELOG][2.0.16-changelog] | [v2.0.16 README][2.0.16-readme] |
-| 2.0.15  | 2025-09-08   | [v2.0.15 CHANGELOG][2.0.15-changelog] | [v2.0.15 README][2.0.15-readme] |
-| 2.0.14  | 2025-08-31   | [v2.0.14 CHANGELOG][2.0.14-changelog] | [v2.0.14 README][2.0.14-readme] |
-| 2.0.13  | 2025-08-30   | [v2.0.13 CHANGELOG][2.0.13-changelog] | [v2.0.13 README][2.0.13-readme] |
-| 2.0.12  | 2025-05-31   | [v2.0.12 CHANGELOG][2.0.12-changelog] | [v2.0.12 README][2.0.12-readme] |
-| 2.0.11  | 2025-05-23   | [v2.0.11 CHANGELOG][2.0.11-changelog] | [v2.0.11 README][2.0.11-readme] |
-| 2.0.10  | 2025-05-17   | [v2.0.10 CHANGELOG][2.0.10-changelog] | [v2.0.10 README][2.0.10-readme] |
-| 2.0.9   | 2022-09-16   | [v2.0.9 CHANGELOG][2.0.9-changelog]   | [v2.0.9 README][2.0.9-readme]   |
-| 2.0.8   | 2022-09-01   | [v2.0.8 CHANGELOG][2.0.8-changelog]   | [v2.0.8 README][2.0.8-readme]   |
-| 2.0.7   | 2022-08-22   | [v2.0.7 CHANGELOG][2.0.7-changelog]   | [v2.0.7 README][2.0.7-readme]   |
-| 2.0.6   | 2022-07-13   | [v2.0.6 CHANGELOG][2.0.6-changelog]   | [v2.0.6 README][2.0.6-readme]   |
-| 2.0.5   | 2022-07-07   | [v2.0.5 CHANGELOG][2.0.5-changelog]   | [v2.0.5 README][2.0.5-readme]   |
-| 2.0.4   | 2022-07-01   | [v2.0.4 CHANGELOG][2.0.4-changelog]   | [v2.0.4 README][2.0.4-readme]   |
-| 2.0.3   | 2022-06-28   | [v2.0.3 CHANGELOG][2.0.3-changelog]   | [v2.0.3 README][2.0.3-readme]   |
-| 2.0.2   | 2022-06-24   | [v2.0.2 CHANGELOG][2.0.2-changelog]   | [v2.0.2 README][2.0.2-readme]   |
-| 2.0.1   | 2022-06-22   | [v2.0.1 CHANGELOG][2.0.1-changelog]   | [v2.0.1 README][2.0.1-readme]   |
-| 2.0.0   | 2022-06-21   | [v2.0.0 CHANGELOG][2.0.0-changelog]   | [v2.0.0 README][2.0.0-readme]   |
-
-</details>
-
-[2.0.17-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2017---2025-09-15
-[2.0.16-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2016---2025-09-14
-[2.0.15-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2015---2025-09-08
-[2.0.14-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2014---2025-08-31
-[2.0.13-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2013---2025-08-30
-[2.0.12-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2012---2025-05-31
-[2.0.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2011---2025-05-23
-[2.0.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2010---2025-05-17
-[2.0.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#209---2022-09-16
-[2.0.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#208---2022-09-01
-[2.0.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#207---2022-08-22
-[2.0.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#206---2022-07-13
-[2.0.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#205---2022-07-07
-[2.0.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#204---2022-07-01
-[2.0.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#203---2022-06-28
-[2.0.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#202---2022-06-24
-[2.0.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#201---2022-06-22
-[2.0.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#200---2022-06-21
-
-[2.0.17-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.17/README.md
-[2.0.16-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.16/README.md
-[2.0.15-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.15/README.md
-[2.0.14-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.14/README.md
-[2.0.13-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.13/README.md
-[2.0.12-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.12/README.md
-[2.0.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.11/README.md
-[2.0.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.10/README.md
-[2.0.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.9/README.md
-[2.0.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.8/README.md
-[2.0.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.7/README.md
-[2.0.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.6/README.md
-[2.0.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.5/README.md
-[2.0.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.4/README.md
-[2.0.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.3/README.md
-[2.0.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.2/README.md
-[2.0.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.1/README.md
-[2.0.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.0/README.md
-
-### Older Releases
-
-<details>
-  <summary>1.4.x CHANGELOGs and READMEs</summary>
-
-| Version | Release Date | CHANGELOG                             | README                          |
-|---------|--------------|---------------------------------------|---------------------------------|
-| 1.4.11  | Sep 16, 2022 | [v1.4.11 CHANGELOG][1.4.11-changelog] | [v1.4.11 README][1.4.11-readme] |
-| 1.4.10  | Jul 1, 2022  | [v1.4.10 CHANGELOG][1.4.10-changelog] | [v1.4.10 README][1.4.10-readme] |
-| 1.4.9   | Feb 20, 2022 | [v1.4.9 CHANGELOG][1.4.9-changelog]   | [v1.4.9 README][1.4.9-readme]   |
-| 1.4.8   | Feb 18, 2022 | [v1.4.8 CHANGELOG][1.4.8-changelog]   | [v1.4.8 README][1.4.8-readme]   |
-| 1.4.7   | Mar 19, 2021 | [v1.4.7 CHANGELOG][1.4.7-changelog]   | [v1.4.7 README][1.4.7-readme]   |
-| 1.4.6   | Mar 19, 2021 | [v1.4.6 CHANGELOG][1.4.6-changelog]   | [v1.4.6 README][1.4.6-readme]   |
-| 1.4.5   | Mar 18, 2021 | [v1.4.5 CHANGELOG][1.4.5-changelog]   | [v1.4.5 README][1.4.5-readme]   |
-| 1.4.4   | Feb 12, 2020 | [v1.4.4 CHANGELOG][1.4.4-changelog]   | [v1.4.4 README][1.4.4-readme]   |
-| 1.4.3   | Jan 29, 2020 | [v1.4.3 CHANGELOG][1.4.3-changelog]   | [v1.4.3 README][1.4.3-readme]   |
-| 1.4.2   | Oct 1, 2019  | [v1.4.2 CHANGELOG][1.4.2-changelog]   | [v1.4.2 README][1.4.2-readme]   |
-| 1.4.1   | Oct 13, 2018 | [v1.4.1 CHANGELOG][1.4.1-changelog]   | [v1.4.1 README][1.4.1-readme]   |
-| 1.4.0   | Jun 9, 2017  | [v1.4.0 CHANGELOG][1.4.0-changelog]   | [v1.4.0 README][1.4.0-readme]   |
-</details>
-
-[1.4.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1411---2022-09-16
-[1.4.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1410---2022-07-01
-[1.4.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#149---2022-02-20
-[1.4.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#148---2022-02-18
-[1.4.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#147---2021-03-19
-[1.4.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#146---2021-03-19
-[1.4.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#145---2021-03-18
-[1.4.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#144---2020-02-12
-[1.4.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#143---2020-01-29
-[1.4.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#142---2019-10-01
-[1.4.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#141---2018-10-13
-[1.4.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#140---2017-06-09
-
-[1.4.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.11/README.md
-[1.4.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.10/README.md
-[1.4.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.9/README.md
-[1.4.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.8/README.md
-[1.4.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.7/README.md
-[1.4.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.6/README.md
-[1.4.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.5/README.md
-[1.4.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.4/README.md
-[1.4.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.3/README.md
-[1.4.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.2/README.md
-[1.4.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.1/README.md
-[1.4.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.0/README.md
-
-<details>
-  <summary>1.3.x Readmes</summary>
-
-| Version | Release Date | Readme                                                       |
-|---------|--------------|--------------------------------------------------------------|
-| 1.3.1   | Mar 3, 2017  | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.1/README.md |
-| 1.3.0   | Dec 27, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.0/README.md |
-
-</details>
-
-<details>
-  <summary>&le;= 1.2.x Readmes (2016 and before)</summary>
-
-| Version | Release Date | Readme                                                       |
-|---------|--------------|--------------------------------------------------------------|
-| 1.2.0   | Jun 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.2.0/README.md |
-| 1.1.0   | Jan 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.1.0/README.md |
-| 1.0.0   | May 23, 2014 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.0.0/README.md |
-| < 1.0.0 | Find here    | https://gitlab.com/ruby-oauth/oauth2/-/tags                  |
-
-</details>
-
 ## ✨ Installation
 
 Install the gem and add to the application's Gemfile by executing:
@@ -411,14 +236,14 @@ gem install oauth2
 
 ### 🔒 Secure Installation
 
-<details>
+<details markdown="1">
   <summary>For Medium or High Security Installations</summary>
 
-This gem is cryptographically signed and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
+This gem is cryptographically signed, and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
 [stone_checksums][💎stone_checksums]. Be sure the gem you install hasn’t been tampered with
 by following the instructions below.
 
-Add my public key (if you haven’t already; will expire 2045-04-29) as a trusted certificate:
+Add my public key (if you haven’t already, expires 2045-04-29) as a trusted certificate:
 
 ```console
 gem cert --add <(curl -Ls https://raw.github.com/galtzo-floss/certs/main/pboling.pem)
@@ -440,6 +265,8 @@ If you want to up your security game full-time:
 bundle config set --global trust-policy MediumSecurity
 ```
 
+`MediumSecurity` instead of `HighSecurity` is necessary if not all the gems you use are signed.
+
 NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.
 
 </details>
@@ -477,7 +304,7 @@ Compatibility is further distinguished as "Best Effort Support" or "Incidental S
 This gem will install on Ruby versions >= v2.2 for 2.x releases.
 See `1-4-stable` branch for older rubies.
 
-<details>
+<details markdown="1>
   <summary>Ruby Engine Compatibility Policy</summary>
 
 This gem is tested against MRI, JRuby, and Truffleruby.
@@ -485,9 +312,10 @@ Each of those has varying versions that target a specific version of MRI Ruby.
 This gem should work in the just-listed Ruby engines according to the targeted MRI compatibility in the table below.
 If you would like to add support for additional engines,
 see [gemfiles/README.md](gemfiles/README.md), then submit a PR to the correct maintenance branch as according to the table below.
+
 </details>
 
-<details>
+<details markdown="1>
   <summary>Ruby Version Compatibility Policy</summary>
 
 If something doesn't work on one of these interpreters, it's a bug.
@@ -502,6 +330,7 @@ run and pass on that implementation. When something breaks on your
 implementation, you will be responsible for providing patches in a timely
 fashion. If critical issues for a particular implementation exist at the time
 of a major release, support for that Ruby version may be dropped.
+
 </details>
 
 |     | Ruby OAuth2 Version | Maintenance Branch | Targeted Support     | Best Effort Support     | Incidental Support           |
@@ -638,7 +467,11 @@ These extensions work regardless of whether you used the global or discrete conf
 
 There are a few hacks you may need in your class to support Ruby < 2.4.2 or < 2.6.
 They are likely not needed if you are on a newer Ruby.
-See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb) if you need to study the hacks for older Rubies.
+Expand the examples below, or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem,
+or [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), for more ideas, especially if you need to study the hacks for older Rubies.
+
+<details markdown="1>
+<summary>See Examples</summary>
 
 ```ruby
 class MySnakyHash < SnakyHash::StringKeyed
@@ -694,7 +527,7 @@ class MySnakyHash < SnakyHash::StringKeyed
 end
 ```
 
-See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem for more ideas.
+</details>
 
 #### Prefer camelCase over snake_case? => snaky: false
 
@@ -707,7 +540,7 @@ response.parsed["additionalData"] # => "additional"
 response.parsed.class.name        # => Hash (just, regular old Hash)
 ```
 
-<details>
+<details markdown="1">
   <summary>Debugging & Logging</summary>
 
 Set an environment variable as per usual (e.g. with [dotenv](https://github.com/bkeepers/dotenv)).
@@ -729,6 +562,7 @@ client = OAuth2::Client.new(
   logger: Logger.new("example.log", "weekly"),
 )
 ```
+
 </details>
 
 ### OAuth2::Response
@@ -752,6 +586,7 @@ a hash of the values), or `from_kvform` (if you have an
 `application/x-www-form-urlencoded` encoded string of the values).
 
 Options (since v2.0.x unless noted):
+
 - `expires_latency` (Integer | nil): Seconds to subtract from expires_in when computing #expired? to offset latency.
 - `token_name` (String | Symbol | nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).
 - `mode` (Symbol | Proc | Hash): Controls how the token is transmitted on requests made via this AccessToken instance.
@@ -762,6 +597,7 @@ Options (since v2.0.x unless noted):
     - a `Hash` with verb symbols as keys, for example `{get: :query, post: :header, delete: :header}`.
 
 Note: Verb-dependent mode supports providers like Instagram that require query mode for `GET` and header mode for `POST`/`DELETE`
+
 - Verb-dependent mode via `Proc` was added in v2.0.15
 - Verb-dependent mode via `Hash` was added in v2.0.16
 
@@ -780,6 +616,7 @@ Response instance will contain the `OAuth2::Error` instance.
 ### Authorization Grants
 
 Note on OAuth 2.1 (draft):
+
 - PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.
 - Redirect URIs must be compared using exact string matching by the Authorization Server.
 - The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.
@@ -788,6 +625,7 @@ Note on OAuth 2.1 (draft):
 - The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.
 
 References:
+
 - OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
 - Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
 - FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1
@@ -804,6 +642,7 @@ use. They are available via the [`#auth_code`](https://gitlab.com/ruby-oauth/oau
 [`#assertion`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
 
 These aren't full examples, but demonstrative of the differences between usage for each strategy.
+
 ```ruby
 auth_url = client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth/callback")
 access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback")
@@ -887,7 +726,7 @@ access = client.password.get_token("jdoe", "s3cret", scope: "read")
 
 #### Examples
 
-<details>
+<details markdown="1">
 <summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
 
 ```ruby
@@ -928,6 +767,7 @@ puts access.to_hash # full token response
 ```
 
 Notes:
+
 - Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.
 - If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often "/" or a login page) and pass it to headers.
 - For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.
@@ -937,6 +777,7 @@ Notes:
 ### Instagram API (verb‑dependent token mode)
 
 Providers like Instagram require the access token to be sent differently depending on the HTTP verb:
+
 - GET requests: token must be in the query string (?access_token=...)
 - POST/DELETE requests: token must be in the Authorization header (Bearer ...)
 
@@ -1001,8 +842,9 @@ me = long_lived.get("/me", params: {fields: "id,username"}).parsed
 ```
 
 Tips:
-- Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for GET.
-- If you need a custom rule, you can pass a Proc for mode, e.g. mode: ->(verb) { verb == :get ? :query : :header }.
+
+- Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for `GET` requests.
+- If you need a custom rule, you can pass a `Proc` for `mode`, e.g. `mode: ->(verb) { verb == :get ? :query : :header }`.
 
 ### Refresh Tokens
 
@@ -1107,16 +949,17 @@ resp = access.get("/v1/protected")
 ```
 
 Notes:
-- Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"]).
+
+- Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to `OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"])`.
 - If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
-  - p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])
-  - client_cert = p12.certificate; client_key = p12.key
+  - `p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])`
+  - `client_cert = p12.certificate; client_key = p12.key`
 - Server trust:
-  - If your environment does not have system CAs, specify ca_file or ca_path inside the ssl: hash.
-  - Keep verify: true in production. Set verify: false only for local testing.
-- Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. net_http (default) and net_http_persistent are common choices.
+  - If your environment does not have system CAs, specify `ca_file` or `ca_path` inside the `ssl:` hash.
+  - Keep `verify: true` in production. Set `verify: false` only for local testing.
+- Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. `net_http` (default) and `net_http_persistent` are common choices.
 - Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).
-- OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via auth_scheme: :tls_client_auth as shown above.
+- OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via `auth_scheme: :tls_client_auth` as shown above.
 
 #### Authentication schemes for the token request
 
@@ -1148,9 +991,9 @@ client = OAuth2::Client.new(
 end
 ```
 
-##### Using flat query params (Faraday::FlatParamsEncoder)
+##### Using flat query params (`Faraday::FlatParamsEncoder`)
 
-Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides FlatParamsEncoder for this purpose. You can configure the oauth2 client to use it when building requests.
+Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides `FlatParamsEncoder` for this purpose. You can configure the oauth2 client to use it when building requests.
 
 ```ruby
 require "faraday"
@@ -1280,7 +1123,7 @@ and [Tidelift][🏙️entsup-tidelift].
 
 ### Open Collective for Individuals
 
-Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/kettle-rb#backer)]
+Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/ruby-oauth#backer)]
 
 NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
 
@@ -1290,27 +1133,19 @@ No backers yet. Be the first!
 
 ### Open Collective for Organizations
 
-Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/kettle-rb#sponsor)]
+Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/ruby-oauth#sponsor)]
 
 NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
 
 <!-- OPENCOLLECTIVE-ORGANIZATIONS:START -->
 No sponsors yet. Be the first!
-
-### Open Collective for Donors
-
-<a href="https://opencollective.com/ruby-oauth/backer/0/website" target="_blank"><img src="https://opencollective.com/ruby-oauth/backer/0/avatar.svg"></a>
-
 <!-- OPENCOLLECTIVE-ORGANIZATIONS:END -->
 
-[kettle-readme-backers]: https://github.com/kettle-rb/kettle-dev/blob/main/exe/kettle-readme-backers
+[kettle-readme-backers]: https://github.com/ruby-oauth/oauth2/blob/main/exe/kettle-readme-backers
 
 ### Another way to support open-source
 
-> How wonderful it is that nobody need wait a single moment before starting to improve the world.<br/>
->—Anne Frank
-
-I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions — totaling 79 hours of FLOSS coding over just the past seven days, a pretty regular week for me.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
+I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
 
 If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
 
@@ -1318,7 +1153,7 @@ I’m developing a new library, [floss_funding][🖇floss-funding-gem], designed
 
 **[Floss-Funding.dev][🖇floss-funding.dev]: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags**
 
-[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS or refugee efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS or refugee efforts using Patreon][🖇patreon-img]][🖇patreon]
+[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS efforts using Patreon][🖇patreon-img]][🖇patreon]
 
 ## 🔐 Security
 
@@ -1397,12 +1232,11 @@ For example:
 spec.add_dependency("oauth2", "~> 2.0")
 ```
 
-<details>
+<details markdown="1">
 <summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
 
 SemVer should, IMO, but doesn't explicitly, say that dropping support for specific Platforms
-is a *breaking change* to an API.
-It is obvious to many, but not all, and since the spec is silent, the bike shedding is endless.
+is a *breaking change* to an API, and for that reason the bike shedding is endless.
 
 To get a better understanding of how SemVer is intended to work over a project's lifetime,
 read this article from the creator of SemVer:
@@ -1423,7 +1257,7 @@ See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright
 
 <ul>
     <li>
-        Copyright (c) 2017–2025 Peter H. Boling, of
+        Copyright (c) 2017 – 2025 Peter H. Boling, of
         <a href="https://discord.gg/3qme4XHNKN">
             Galtzo.com
             <picture>
@@ -1432,15 +1266,15 @@ See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright
         </a>, and oauth2 contributors.
     </li>
     <li>
-        Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.
+        Copyright (c) 2011 - 2013 Michael Bleigh and Intridea, Inc.
     </li>
 </ul>
 
 ## 🤑 A request for help
 
 Maintainers have teeth and need to pay their dentists.
-After getting laid off in an RIF in March and filled with many dozens of rejections,
-I'm now spending ~60+ hours a week building open source tools.
+After getting laid off in an RIF in March, and encountering difficulty finding a new one,
+I began spending most of my time building open source tools.
 I'm hoping to be able to pay for my kids' health insurance this month,
 so if you value the work I am doing, I need your support.
 Please consider sponsoring me or the project.
@@ -1451,7 +1285,7 @@ To join the community or get help 👇️ Join the Discord.
 
 To say "thanks!" ☝️ Join the Discord or 👇️ send money.
 
-[![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay-img] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal-img]
+[![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal]
 
 ### Please give the project a star ⭐ ♥.
 
@@ -1499,7 +1333,7 @@ Thanks for RTFM. ☺️
 [✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
 [⛳️gem-namespace]: https://github.com/ruby-oauth/oauth2
 [⛳️namespace-img]: https://img.shields.io/badge/namespace-OAuth2-3C2D2D.svg?style=square&logo=ruby&logoColor=white
-[⛳️gem-name]: https://rubygems.org/gems/oauth2
+[⛳️gem-name]: https://bestgems.org/gems/oauth2
 [⛳️name-img]: https://img.shields.io/badge/name-oauth2-3C2D2D.svg?style=square&logo=rubygems&logoColor=red
 [⛳️tag-img]: https://img.shields.io/github/tag/ruby-oauth/oauth2.svg
 [⛳️tag]: http://github.com/ruby-oauth/oauth2/releases
@@ -1548,11 +1382,11 @@ Thanks for RTFM. ☺️
 [📜gh-wiki]: https://github.com/ruby-oauth/oauth2/wiki
 [📜gl-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=gitlab&logoColor=white
 [📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
-[👽dl-rank]: https://rubygems.org/gems/oauth2
+[👽dl-rank]: https://bestgems.org/gems/oauth2
 [👽dl-ranki]: https://img.shields.io/gem/rd/oauth2.svg
 [👽oss-help]: https://www.codetriage.com/ruby-oauth/oauth2
 [👽oss-helpi]: https://www.codetriage.com/ruby-oauth/oauth2/badges/users.svg
-[👽version]: https://rubygems.org/gems/oauth2
+[👽version]: https://bestgems.org/gems/oauth2
 [👽versioni]: https://img.shields.io/gem/v/oauth2.svg
 [🏀qlty-mnt]: https://qlty.sh/gh/ruby-oauth/projects/oauth2
 [🏀qlty-mnti]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg
@@ -1580,8 +1414,6 @@ Thanks for RTFM. ☺️
 [🚎7-us-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml/badge.svg
 [🚎8-ho-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml
 [🚎8-ho-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml/badge.svg
-[🚎9-t-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml
-[🚎9-t-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml/badge.svg
 [🚎10-j-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml
 [🚎10-j-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml/badge.svg
 [🚎11-c-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml
@@ -1610,7 +1442,7 @@ Thanks for RTFM. ☺️
 [💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&logo=ruby&logoColor=blue
 [💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
-[💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
+[💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&logo=ruby&logoColor=green
 [💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&logo=ruby&logoColor=blue
 [💎jruby-9.1i]: https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=red
@@ -1642,8 +1474,8 @@ Thanks for RTFM. ☺️
 [📌changelog]: CHANGELOG.md
 [📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
 [📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat
-[📌gitmoji]:https://gitmoji.dev
-[📌gitmoji-img]:https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
+[📌gitmoji]: https://gitmoji.dev
+[📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
 [🧮kloc-img]: https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: SECURITY.md
diff --git a/Rakefile b/Rakefile
index 9f4f39b6..631e8b13 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# kettle-dev Rakefile v1.1.24 - 2025-09-17
+# kettle-dev Rakefile v1.1.51 - 2025-11-07
 # Ruby 2.3 (Safe Navigation) or higher required
 #
 # MIT License (see License.txt)
diff --git a/docs/.nojekyll b/docs/.nojekyll
deleted file mode 100644
index e69de29b..00000000
diff --git a/docs/CNAME b/docs/CNAME
deleted file mode 100644
index 9e32e7bf..00000000
--- a/docs/CNAME
+++ /dev/null
@@ -1 +0,0 @@
-oauth2.galtzo.com
\ No newline at end of file
diff --git a/docs/OAuth2.html b/docs/OAuth2.html
index 3ca5c041..1ffcdd17 100644
--- a/docs/OAuth2.html
+++ b/docs/OAuth2.html
@@ -119,8 +119,8 @@ <h2>
         <dt id="OAUTH_DEBUG-constant" class="">OAUTH_DEBUG =
           <div class="docstring">
   <div class="discussion">
-    <p>When true, enables verbose HTTP logging via Faraday’s logger middleware.<br />
-Controlled by the OAUTH_DEBUG environment variable. Any case-insensitive<br />
+    <p>When true, enables verbose HTTP logging via Faraday’s logger middleware.
+Controlled by the OAUTH_DEBUG environment variable. Any case-insensitive
 value equal to “true” will enable debugging.</p>
 
 
@@ -415,9 +415,9 @@ <h3 class="signature first" id="configure-class_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/AccessToken.html b/docs/OAuth2/AccessToken.html
index 7d07ab1e..2d0ed1df 100644
--- a/docs/OAuth2/AccessToken.html
+++ b/docs/OAuth2/AccessToken.html
@@ -826,13 +826,13 @@ <h3 class="signature first" id="initialize-instance_method">
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If no token is provided, the AccessToken will be considered invalid.<br />
-This is to prevent the possibility of a token being accidentally<br />
-created with no token value.<br />
-If you want to create an AccessToken with no token value,<br />
-you can pass in an empty string or nil for the token value.<br />
-If you want to create an AccessToken with no token value and<br />
-no refresh token, you can pass in an empty string or nil for the<br />
+    <div class='inline'><p>If no token is provided, the AccessToken will be considered invalid.
+This is to prevent the possibility of a token being accidentally
+created with no token value.
+If you want to create an AccessToken with no token value,
+you can pass in an empty string or nil for the token value.
+If you want to create an AccessToken with no token value and
+no refresh token, you can pass in an empty string or nil for the
 token value and nil for the refresh token, and <code>raise_errors: false</code>.</p>
 </div>
   </div>
@@ -987,9 +987,9 @@ <h5 class="example_title"><div class='inline'><p>Verb-dependent Hash mode</p>
             
           </span>
           
-            &mdash; <div class='inline'><p>the transmission mode of the Access Token parameter value:<br />
-either one of :header, :body or :query; or a Hash with verb symbols as keys mapping to one of these symbols<br />
-(e.g., :query, post: :header, delete: :header); or a callable that accepts a request-verb parameter<br />
+            &mdash; <div class='inline'><p>the transmission mode of the Access Token parameter value:
+either one of :header, :body or :query; or a Hash with verb symbols as keys mapping to one of these symbols
+(e.g., <code>{get: :query, post: :header, delete: :header}</code>); or a callable that accepts a request-verb parameter
 and returns one of these three symbols.</p>
 </div>
           
@@ -1020,7 +1020,7 @@ <h5 class="example_title"><div class='inline'><p>Verb-dependent Hash mode</p>
             
           </span>
           
-            &mdash; <div class='inline'><p>the parameter name to use for transmission of the<br />
+            &mdash; <div class='inline'><p>the parameter name to use for transmission of the
 Access Token value in :body or :query transmission mode</p>
 </div>
           
@@ -1036,7 +1036,7 @@ <h5 class="example_title"><div class='inline'><p>Verb-dependent Hash mode</p>
             
           </span>
           
-            &mdash; <div class='inline'><p>the name of the response parameter that identifies the access token<br />
+            &mdash; <div class='inline'><p>the name of the response parameter that identifies the access token
 When nil one of TOKEN_KEY_LOOKUP will be used</p>
 </div>
           
@@ -1533,21 +1533,21 @@ <h3 class="signature first" id="from_hash-class_method">
     
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>The method will use the first found token key in the following order:<br />
+    <div class='inline'><p>The method will use the first found token key in the following order:
 ‘access_token’, ‘id_token’, ‘token’ (or their symbolic versions)</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If multiple token keys are present, a warning will be issued unless<br />
+    <div class='inline'><p>If multiple token keys are present, a warning will be issued unless
 OAuth2.config.silence_extra_tokens_warning is true</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If no token keys are present, a warning will be issued unless<br />
+    <div class='inline'><p>If no token keys are present, a warning will be issued unless
 OAuth2.config.silence_no_tokens_warning is true</p>
 </div>
   </div>
@@ -2746,28 +2746,28 @@ <h3 class="signature " id="revoke-instance_method">
     
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If the token passed to the request<br />
-is an access token, the server MAY revoke the respective refresh<br />
+    <div class='inline'><p>If the token passed to the request
+is an access token, the server MAY revoke the respective refresh
 token as well.</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If the token passed to the request<br />
-is a refresh token and the authorization server supports the<br />
-revocation of access tokens, then the authorization server SHOULD<br />
-also invalidate all access tokens based on the same authorization<br />
+    <div class='inline'><p>If the token passed to the request
+is a refresh token and the authorization server supports the
+revocation of access tokens, then the authorization server SHOULD
+also invalidate all access tokens based on the same authorization
 grant</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If the server responds with HTTP status code 503, your code must<br />
-assume the token still exists and may retry after a reasonable delay.<br />
-The server may include a “Retry-After” header in the response to<br />
-indicate how long the service is expected to be unavailable to the<br />
+    <div class='inline'><p>If the server responds with HTTP status code 503, your code must
+assume the token still exists and may retry after a reasonable delay.
+The server may include a “Retry-After” header in the response to
+indicate how long the service is expected to be unavailable to the
 requesting client.</p>
 </div>
   </div>
@@ -3083,9 +3083,9 @@ <h3 class="signature " id="to_hash-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Authenticator.html b/docs/OAuth2/Authenticator.html
index 0cb01dbe..53736878 100644
--- a/docs/OAuth2/Authenticator.html
+++ b/docs/OAuth2/Authenticator.html
@@ -108,7 +108,7 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>Builds and applies client authentication to token and revoke requests.</p>
 
-<p>Depending on the selected mode, credentials are applied as Basic Auth<br />
+<p>Depending on the selected mode, credentials are applied as Basic Auth
 headers, request body parameters, or only the client_id is sent (TLS).</p>
 
 
@@ -788,7 +788,7 @@ <h3 class="signature first" id="apply-instance_method">
   <div class="discussion">
     <p>Apply the request credentials used to authenticate to the Authorization Server</p>
 
-<p>Depending on the configuration, this might be as request params or as an<br />
+<p>Depending on the configuration, this might be as request params or as an
 Authorization header.</p>
 
 <p>User-provided params and header take precedence.</p>
@@ -883,9 +883,9 @@ <h3 class="signature first" id="apply-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Client.html b/docs/OAuth2/Client.html
index c50ad592..9ff6fc48 100644
--- a/docs/OAuth2/Client.html
+++ b/docs/OAuth2/Client.html
@@ -1243,7 +1243,7 @@ <h3 class="signature first" id="assertion-instance_method">
   <div class="discussion">
     <p>The Assertion strategy</p>
 
-<p>This allows for assertion-based authentication where an identity provider<br />
+<p>This allows for assertion-based authentication where an identity provider
 asserts the identity of the user or client application seeking access.</p>
 
 
@@ -1487,7 +1487,7 @@ <h3 class="signature " id="get_token-instance_method">
     
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>The extract_access_token parameter is deprecated and will be removed in oauth2 v3.<br />
+    <div class='inline'><p>The extract_access_token parameter is deprecated and will be removed in oauth2 v3.
 Use access_token_class on initialization instead.</p>
 </div>
   </div>
@@ -1523,12 +1523,10 @@ <h4 class="tag_title">Examples:</h4>
       
       
         &mdash;
-        <div class='inline'><p>a Hash of params for the token endpoint</p>
-<ul>
-  <li>params can include a ‘headers’ key with a Hash of request headers</li>
-  <li>params can include a ‘parse’ key with the Symbol name of response parsing strategy (default: :automatic)</li>
-  <li>params can include a ‘snaky’ key to control snake_case conversion (default: false)</li>
-</ul>
+        <div class='inline'><p>a Hash of params for the token endpoint
+* params can include a ‘headers’ key with a Hash of request headers
+* params can include a ‘parse’ key with the Symbol name of response parsing strategy (default: :automatic)
+* params can include a ‘snaky’ key to control snake_case conversion (default: false)</p>
 </div>
       
     </li>
@@ -1616,7 +1614,7 @@ <h4 class="tag_title">Examples:</h4>
       
       
         &mdash;
-        <div class='inline'><p>the initialized AccessToken instance, or nil if token extraction fails<br />
+        <div class='inline'><p>the initialized AccessToken instance, or nil if token extraction fails
 and raise_errors is false</p>
 </div>
       
@@ -1839,14 +1837,14 @@ <h3 class="signature " id="redirection_params-instance_method">
   <div class="discussion">
     <p>The redirect_uri parameters, if configured</p>
 
-<p>The redirect_uri query parameter is OPTIONAL (though encouraged) when<br />
-requesting authorization. If it is provided at authorization time it MUST<br />
+<p>The redirect_uri query parameter is OPTIONAL (though encouraged) when
+requesting authorization. If it is provided at authorization time it MUST
 also be provided with the token exchange request.</p>
 
-<p>OAuth 2.1 note: Authorization Servers must compare redirect URIs using exact string matching.<br />
+<p>OAuth 2.1 note: Authorization Servers must compare redirect URIs using exact string matching.
 This client simply forwards the configured redirect_uri; the exact-match validation happens server-side.</p>
 
-<p>Providing :redirect_uri to the OAuth2::Client instantiation will take<br />
+<p>Providing :redirect_uri to the OAuth2::Client instantiation will take
 care of managing this.</p>
 
 
@@ -1929,7 +1927,7 @@ <h3 class="signature " id="request-instance_method">
   <div class="discussion">
     <p>Makes a request relative to the specified site root.</p>
 
-<p>Updated HTTP 1.1 specification (IETF RFC 7231) relaxed the original constraint (IETF RFC 2616),<br />
+<p>Updated HTTP 1.1 specification (IETF RFC 7231) relaxed the original constraint (IETF RFC 2616),
   allowing the use of relative URLs in Location headers.</p>
 
 
@@ -2041,7 +2039,7 @@ <h3 class="signature " id="request-instance_method">
             
           </span>
           
-            &mdash; <div class='inline'><p>whether to raise an OAuth2::Error on 400+ status<br />
+            &mdash; <div class='inline'><p>whether to raise an OAuth2::Error on 400+ status
 code response for this request.  Overrides the client instance setting.</p>
 </div>
           
@@ -2243,28 +2241,28 @@ <h3 class="signature " id="revoke_token-instance_method">
     
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If the token passed to the request<br />
-is an access token, the server MAY revoke the respective refresh<br />
+    <div class='inline'><p>If the token passed to the request
+is an access token, the server MAY revoke the respective refresh
 token as well.</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If the token passed to the request<br />
-is a refresh token and the authorization server supports the<br />
-revocation of access tokens, then the authorization server SHOULD<br />
-also invalidate all access tokens based on the same authorization<br />
+    <div class='inline'><p>If the token passed to the request
+is a refresh token and the authorization server supports the
+revocation of access tokens, then the authorization server SHOULD
+also invalidate all access tokens based on the same authorization
 grant</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If the server responds with HTTP status code 503, your code must<br />
-assume the token still exists and may retry after a reasonable delay.<br />
-The server may include a “Retry-After” header in the response to<br />
-indicate how long the service is expected to be unavailable to the<br />
+    <div class='inline'><p>If the server responds with HTTP status code 503, your code must
+assume the token still exists and may retry after a reasonable delay.
+The server may include a “Retry-After” header in the response to
+indicate how long the service is expected to be unavailable to the
 requesting client.</p>
 </div>
   </div>
@@ -2656,9 +2654,9 @@ <h3 class="signature " id="token_url-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Error.html b/docs/OAuth2/Error.html
index 2e23dff5..1401cd95 100644
--- a/docs/OAuth2/Error.html
+++ b/docs/OAuth2/Error.html
@@ -105,7 +105,7 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>Represents an OAuth2 error condition.</p>
 
-<p>Wraps details from an OAuth2::Response or Hash payload returned by an<br />
+<p>Wraps details from an OAuth2::Response or Hash payload returned by an
 authorization server, exposing error code and description per RFC 6749.</p>
 
 
@@ -772,9 +772,9 @@ <h3 class="signature " id="response-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/FilteredAttributes.html b/docs/OAuth2/FilteredAttributes.html
index 93942485..7c738657 100644
--- a/docs/OAuth2/FilteredAttributes.html
+++ b/docs/OAuth2/FilteredAttributes.html
@@ -92,8 +92,8 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>Mixin that redacts sensitive instance variables in #inspect output.</p>
 
-<p>Classes include this module and declare which attributes should be filtered<br />
-using filtered_attributes. Any instance variable name that includes one of<br />
+<p>Classes include this module and declare which attributes should be filtered
+using filtered_attributes. Any instance variable name that includes one of
 those attribute names will be shown as [FILTERED] in the object’s inspect.</p>
 
 
@@ -202,7 +202,7 @@ <h3 class="signature first" id="included-class_method">
   
 </h3><div class="docstring">
   <div class="discussion">
-    <p class="note returns_void">This method returns an undefined value.</p><p>Hook invoked when the module is included. Extends the including class with<br />
+    <p class="note returns_void">This method returns an undefined value.</p><p>Hook invoked when the module is included. Extends the including class with
 class-level helpers.</p>
 
 
@@ -335,9 +335,9 @@ <h3 class="signature first" id="inspect-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/FilteredAttributes/ClassMethods.html b/docs/OAuth2/FilteredAttributes/ClassMethods.html
index fc2ad592..75bb5568 100644
--- a/docs/OAuth2/FilteredAttributes/ClassMethods.html
+++ b/docs/OAuth2/FilteredAttributes/ClassMethods.html
@@ -280,9 +280,9 @@ <h3 class="signature " id="filtered_attributes-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Response.html b/docs/OAuth2/Response.html
index f2f77289..dccdc25b 100644
--- a/docs/OAuth2/Response.html
+++ b/docs/OAuth2/Response.html
@@ -101,7 +101,7 @@
 
 <h2>Overview</h2><div class="docstring">
   <div class="discussion">
-    <p>The Response class handles HTTP responses in the OAuth2 gem, providing methods<br />
+    <p>The Response class handles HTTP responses in the OAuth2 gem, providing methods
 to access and parse response data in various formats.</p>
 
 
@@ -1430,22 +1430,22 @@ <h3 class="signature " id="parser-instance_method">
     
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>The parser can be supplied as the +:parse+ option in the form of a Proc<br />
-(or other Object responding to #call) or a Symbol. In the latter case,<br />
+    <div class='inline'><p>The parser can be supplied as the +:parse+ option in the form of a Proc
+(or other Object responding to #call) or a Symbol. In the latter case,
 the actual parser will be looked up in <span class='object_link'><a href="#parsers-classvariable" title="OAuth2::Response::@@parsers (classvariable)">@@parsers</a></span> by the supplied Symbol.</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If no +:parse+ option is supplied, the lookup Symbol will be determined<br />
+    <div class='inline'><p>If no +:parse+ option is supplied, the lookup Symbol will be determined
 by looking up <span class='object_link'><a href="#content_type-instance_method" title="OAuth2::Response#content_type (method)">#content_type</a></span> in <span class='object_link'><a href="#content_types-classvariable" title="OAuth2::Response::@@content_types (classvariable)">@@content_types</a></span>.</p>
 </div>
   </div>
 
   <div class="note notetag">
     <strong>Note:</strong>
-    <div class='inline'><p>If <span class='object_link'><a href="#parser-instance_method" title="OAuth2::Response#parser (method)">#parser</a></span> is a Proc, it will be called with no arguments, just<br />
+    <div class='inline'><p>If <span class='object_link'><a href="#parser-instance_method" title="OAuth2::Response#parser (method)">#parser</a></span> is a Proc, it will be called with no arguments, just
 <span class='object_link'><a href="#body-instance_method" title="OAuth2::Response#body (method)">#body</a></span>, or <span class='object_link'><a href="#body-instance_method" title="OAuth2::Response#body (method)">#body</a></span> and <span class='object_link'><a href="#response-instance_method" title="OAuth2::Response#response (method)">#response</a></span>, depending on the Proc’s arity.</p>
 </div>
   </div>
@@ -1619,9 +1619,9 @@ <h3 class="signature " id="status-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy.html b/docs/OAuth2/Strategy.html
index a75d5e8d..c629c668 100644
--- a/docs/OAuth2/Strategy.html
+++ b/docs/OAuth2/Strategy.html
@@ -107,9 +107,9 @@ <h2>Defined Under Namespace</h2>
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy/Assertion.html b/docs/OAuth2/Strategy/Assertion.html
index 8f3917bb..6153d6fa 100644
--- a/docs/OAuth2/Strategy/Assertion.html
+++ b/docs/OAuth2/Strategy/Assertion.html
@@ -105,25 +105,25 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>The Client Assertion Strategy</p>
 
-<p>Sample usage:<br />
-  client = OAuth2::Client.new(client_id, client_secret,<br />
-                              :site =&gt; ‘http://localhost:8080’,<br />
+<p>Sample usage:
+  client = OAuth2::Client.new(client_id, client_secret,
+                              :site =&gt; ‘http://localhost:8080’,
                               :auth_scheme =&gt; :request_body)</p>
 
-<p>claim_set = {<br />
-    :iss =&gt; “http://localhost:3001”,<br />
-    :aud =&gt; “http://localhost:8080/oauth2/token”,<br />
-    :sub =&gt; “me@example.com”,<br />
-    :exp =&gt; Time.now.utc.to_i + 3600,<br />
+<p>claim_set = {
+    :iss =&gt; “http://localhost:3001”,
+    :aud =&gt; “http://localhost:8080/oauth2/token”,
+    :sub =&gt; “me@example.com”,
+    :exp =&gt; Time.now.utc.to_i + 3600,
   }</p>
 
-<p>encoding = {<br />
-    :algorithm =&gt; ‘HS256’,<br />
-    :key =&gt; ‘secret_key’,<br />
+<p>encoding = {
+    :algorithm =&gt; ‘HS256’,
+    :key =&gt; ‘secret_key’,
   }</p>
 
-<p>access = client.assertion.get_token(claim_set, encoding)<br />
-  access.token                 # actual access_token string<br />
+<p>access = client.assertion.get_token(claim_set, encoding)
+  access.token                 # actual access_token string
   access.get(“/api/stuff”)     # making api calls with access token in header</p>
 
 
@@ -292,29 +292,29 @@ <h3 class="signature " id="get_token-instance_method">
   <div class="discussion">
     <p>Retrieve an access token given the specified client.</p>
 
-<p>For reading on JWT and claim keys:<br />
-  @see https://github.com/jwt/ruby-jwt<br />
-  @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1<br />
-  @see https://datatracker.ietf.org/doc/html/rfc7523#section-3<br />
+<p>For reading on JWT and claim keys:
+  @see https://github.com/jwt/ruby-jwt
+  @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
+  @see https://datatracker.ietf.org/doc/html/rfc7523#section-3
   @see https://www.iana.org/assignments/jwt/jwt.xhtml</p>
 
-<p>There are many possible claim keys, and applications may ask for their own custom keys.<br />
-Some typically required ones:<br />
-  :iss (issuer)<br />
-  :aud (audience)<br />
-  :sub (subject) – formerly :prn https://datatracker.ietf.org/doc/html/draft-ietf-oauth-json-web-token-06#appendix-F<br />
+<p>There are many possible claim keys, and applications may ask for their own custom keys.
+Some typically required ones:
+  :iss (issuer)
+  :aud (audience)
+  :sub (subject) – formerly :prn https://datatracker.ietf.org/doc/html/draft-ietf-oauth-json-web-token-06#appendix-F
   :exp, (expiration time) – in seconds, e.g. Time.now.utc.to_i + 3600</p>
 
-<p>Note that this method does <em>not</em> validate presence of those four claim keys indicated as required by RFC 7523.<br />
+<p>Note that this method does <em>not</em> validate presence of those four claim keys indicated as required by RFC 7523.
 There are endpoints that may not conform with this RFC, and this gem should still work for those use cases.</p>
 
-<p>These two options are passed directly to <code>JWT.encode</code>.  For supported encoding arguments:<br />
-  @see https://github.com/jwt/ruby-jwt#algorithms-and-usage<br />
+<p>These two options are passed directly to <code>JWT.encode</code>.  For supported encoding arguments:
+  @see https://github.com/jwt/ruby-jwt#algorithms-and-usage
   @see https://datatracker.ietf.org/doc/html/rfc7518#section-3.1</p>
 
-<p>The object type of <code>:key</code> may depend on the value of <code>:algorithm</code>.  Sample arguments:<br />
-  get_token(claim_set, =&gt; ‘HS256’, :key =&gt; ‘secret_key’)<br />
-  get_token(claim_set, =&gt; ‘RS256’, :key =&gt; OpenSSL::PKCS12.new(File.read(‘my_key.p12’), ‘not_secret’))</p>
+<p>The object type of <code>:key</code> may depend on the value of <code>:algorithm</code>.  Sample arguments:
+  <code>get_token(claim_set, {:algorithm =&gt; 'HS256', :key =&gt; 'secret_key'})</code>
+  <code>get_token(claim_set, {:algorithm =&gt; 'RS256', :key =&gt; OpenSSL::PKCS12.new(File.read('my_key.p12'), 'not_secret')})</code></p>
 
 
   </div>
@@ -382,7 +382,7 @@ <h3 class="signature " id="get_token-instance_method">
       
       
         &mdash;
-        <div class='inline'><p>this will be merged with the token response to create the AccessToken object<br />
+        <div class='inline'><p>this will be merged with the token response to create the AccessToken object
 @see the access_token_opts argument to Client#get_token</p>
 </div>
       
@@ -437,7 +437,7 @@ <h3 class="signature " id="get_token-instance_method">
             
           </span>
           
-            &mdash; <div class='inline'><p>the url parameter <code>scope</code> that may be required by some endpoints<br />
+            &mdash; <div class='inline'><p>the url parameter <code>scope</code> that may be required by some endpoints
 @see https://datatracker.ietf.org/doc/html/rfc7521#section-4.1</p>
 </div>
           
@@ -481,9 +481,9 @@ <h3 class="signature " id="get_token-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy/AuthCode.html b/docs/OAuth2/Strategy/AuthCode.html
index 9cf98f7c..d5081e25 100644
--- a/docs/OAuth2/Strategy/AuthCode.html
+++ b/docs/OAuth2/Strategy/AuthCode.html
@@ -105,19 +105,15 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>The Authorization Code Strategy</p>
 
-<p>OAuth 2.1 notes:</p>
-<ul>
-  <li>PKCE is required for all OAuth clients using the authorization code flow (especially public clients).<br />
-This library does not enforce PKCE generation/verification; implement PKCE in your application when required.</li>
-  <li>Redirect URIs must be compared using exact string matching by the Authorization Server.<br />
-This client forwards redirect_uri but does not perform server-side validation.</li>
-</ul>
+<p>OAuth 2.1 notes:
+- PKCE is required for all OAuth clients using the authorization code flow (especially public clients).
+  This library does not enforce PKCE generation/verification; implement PKCE in your application when required.
+- Redirect URIs must be compared using exact string matching by the Authorization Server.
+  This client forwards redirect_uri but does not perform server-side validation.</p>
 
-<p>References:</p>
-<ul>
-  <li>OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13</li>
-  <li>OAuth for native apps (RFC 8252) and PKCE (RFC 7636)</li>
-</ul>
+<p>References:
+- OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
+- OAuth for native apps (RFC 8252) and PKCE (RFC 7636)</p>
 
 
   </div>
@@ -483,9 +479,9 @@ <h3 class="signature " id="get_token-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy/Base.html b/docs/OAuth2/Strategy/Base.html
index 4b7954d8..dd410d38 100644
--- a/docs/OAuth2/Strategy/Base.html
+++ b/docs/OAuth2/Strategy/Base.html
@@ -195,9 +195,9 @@ <h3 class="signature first" id="initialize-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy/ClientCredentials.html b/docs/OAuth2/Strategy/ClientCredentials.html
index 32ccd5ca..efa4fdb8 100644
--- a/docs/OAuth2/Strategy/ClientCredentials.html
+++ b/docs/OAuth2/Strategy/ClientCredentials.html
@@ -343,9 +343,9 @@ <h3 class="signature " id="get_token-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy/Implicit.html b/docs/OAuth2/Strategy/Implicit.html
index 8c336a7e..32f63999 100644
--- a/docs/OAuth2/Strategy/Implicit.html
+++ b/docs/OAuth2/Strategy/Implicit.html
@@ -105,15 +105,13 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>The Implicit Strategy</p>
 
-<p>IMPORTANT (OAuth 2.1): The Implicit grant (response_type=token) is omitted from the OAuth 2.1 draft specification.<br />
+<p>IMPORTANT (OAuth 2.1): The Implicit grant (response_type=token) is omitted from the OAuth 2.1 draft specification.
 It remains here for backward compatibility with OAuth 2.0 providers. Prefer the Authorization Code flow with PKCE.</p>
 
-<p>References:</p>
-<ul>
-  <li>OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13</li>
-  <li>Why drop implicit: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1</li>
-  <li>Background: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/</li>
-</ul>
+<p>References:
+- OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
+- Why drop implicit: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
+- Background: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/</p>
 
 
   </div>
@@ -420,9 +418,9 @@ <h3 class="signature " id="get_token-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Strategy/Password.html b/docs/OAuth2/Strategy/Password.html
index c063b0a7..91d2fe7c 100644
--- a/docs/OAuth2/Strategy/Password.html
+++ b/docs/OAuth2/Strategy/Password.html
@@ -105,15 +105,13 @@ <h2>Overview</h2><div class="docstring">
   <div class="discussion">
     <p>The Resource Owner Password Credentials Authorization Strategy</p>
 
-<p>IMPORTANT (OAuth 2.1): The Resource Owner Password Credentials grant is omitted in OAuth 2.1.<br />
+<p>IMPORTANT (OAuth 2.1): The Resource Owner Password Credentials grant is omitted in OAuth 2.1.
 It remains here for backward compatibility with OAuth 2.0 providers. Prefer Authorization Code + PKCE.</p>
 
-<p>References:</p>
-<ul>
-  <li>OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13</li>
-  <li>Okta explainer: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs</li>
-  <li>FusionAuth blog: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1</li>
-</ul>
+<p>References:
+- OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
+- Okta explainer: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs
+- FusionAuth blog: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1</p>
 
 
   </div>
@@ -374,9 +372,9 @@ <h3 class="signature " id="get_token-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/OAuth2/Version.html b/docs/OAuth2/Version.html
index 3959a0a5..35c06cb4 100644
--- a/docs/OAuth2/Version.html
+++ b/docs/OAuth2/Version.html
@@ -111,9 +111,9 @@ <h2>
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/_index.html b/docs/_index.html
index cd86d203..f023b32d 100644
--- a/docs/_index.html
+++ b/docs/_index.html
@@ -93,87 +93,6 @@ <h2>File Listing</h2>
     <li class="r1"><a href="file.LICENSE.html" title="LICENSE">LICENSE</a></li>
     
   
-    <li class="r2"><a href="file.CITATION.html" title="CITATION">CITATION</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.10.gem.html" title="oauth2-2.0.10.gem">oauth2-2.0.10.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.11.gem.html" title="oauth2-2.0.11.gem">oauth2-2.0.11.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.12.gem.html" title="oauth2-2.0.12.gem">oauth2-2.0.12.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.13.gem.html" title="oauth2-2.0.13.gem">oauth2-2.0.13.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.14.gem.html" title="oauth2-2.0.14.gem">oauth2-2.0.14.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.15.gem.html" title="oauth2-2.0.15.gem">oauth2-2.0.15.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.16.gem.html" title="oauth2-2.0.16.gem">oauth2-2.0.16.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.17.gem.html" title="oauth2-2.0.17.gem">oauth2-2.0.17.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.10.gem.html" title="oauth2-2.0.10.gem">oauth2-2.0.10.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.11.gem.html" title="oauth2-2.0.11.gem">oauth2-2.0.11.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.12.gem.html" title="oauth2-2.0.12.gem">oauth2-2.0.12.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.13.gem.html" title="oauth2-2.0.13.gem">oauth2-2.0.13.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.14.gem.html" title="oauth2-2.0.14.gem">oauth2-2.0.14.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.15.gem.html" title="oauth2-2.0.15.gem">oauth2-2.0.15.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.oauth2-2.0.16.gem.html" title="oauth2-2.0.16.gem">oauth2-2.0.16.gem</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2-2.0.17.gem.html" title="oauth2-2.0.17.gem">oauth2-2.0.17.gem</a></li>
-    
-  
-    <li class="r1"><a href="file.REEK.html" title="REEK">REEK</a></li>
-    
-  
-    <li class="r2"><a href="file.access_token.html" title="access_token">access_token</a></li>
-    
-  
-    <li class="r1"><a href="file.authenticator.html" title="authenticator">authenticator</a></li>
-    
-  
-    <li class="r2"><a href="file.client.html" title="client">client</a></li>
-    
-  
-    <li class="r1"><a href="file.error.html" title="error">error</a></li>
-    
-  
-    <li class="r2"><a href="file.filtered_attributes.html" title="filtered_attributes">filtered_attributes</a></li>
-    
-  
-    <li class="r1"><a href="file.response.html" title="response">response</a></li>
-    
-  
-    <li class="r2"><a href="file.strategy.html" title="strategy">strategy</a></li>
-    
-  
-    <li class="r1"><a href="file.version.html" title="version">version</a></li>
-    
-  
-    <li class="r2"><a href="file.oauth2.html" title="oauth2">oauth2</a></li>
-    
-  
   </ul>
 
 <div class="clear"></div>
@@ -396,9 +315,9 @@ <h2>Namespace Listing A-Z</h2>
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:26 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.CHANGELOG.html b/docs/file.CHANGELOG.html
index 43671ea7..b22f44a2 100644
--- a/docs/file.CHANGELOG.html
+++ b/docs/file.CHANGELOG.html
@@ -63,9 +63,9 @@
 
 <p>All notable changes to this project will be documented in this file.</p>
 
-<p>The format is based on <a href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>,<br>
-and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>,<br>
-and <a href="https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html">yes</a>, platform and engine support are part of the <a href="https://github.com/semver/semver/issues/716#issuecomment-869336139">public API</a>.<br>
+<p>The format is based on <a href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>,
+and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>,
+and <a href="https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html">yes</a>, platform and engine support are part of the <a href="https://github.com/semver/semver/issues/716#issuecomment-869336139">public API</a>.
 Please file a bug if you notice a violation of semantic versioning.</p>
 
 <h2 id="unreleased"><a href="https://github.com/ruby-oauth/oauth2/compare/v2.0.17...HEAD">Unreleased</a></h2>
@@ -75,14 +75,18 @@ <h3 id="added">Added</h3>
 <ul>
   <li>
 <a href="https://github.com/ruby-oauth/oauth2/pull/683">gh!683</a>, <a href="https://github.com/ruby-oauth/oauth2/pull/684">gh!684</a> - Improve documentation by @pboling</li>
+  <li>
+<a href="https://github.com/ruby-oauth/oauth2/pull/686">gh!686</a>- Add Incident Response Plan by @pboling</li>
+  <li>
+<a href="https://github.com/ruby-oauth/oauth2/pull/687">gh!687</a>- Add Threat Model by @pboling</li>
 </ul>
 
 <h3 id="changed">Changed</h3>
 
 <ul>
   <li>
-<a href="https://github.com/ruby-oauth/oauth2/pull/685">gh!685</a> - upgrade kettle-dev v1.1.24 by pboling</li>
-  <li>upgrade kettle-dev v1.1.26 by pboling
+<a href="https://github.com/ruby-oauth/oauth2/pull/685">gh!685</a> - upgrade kettle-dev v1.1.24 by @pboling</li>
+  <li>upgrade kettle-dev v1.1.51 by @pboling
     <ul>
       <li>Add open collective donors to README</li>
     </ul>
@@ -95,9 +99,14 @@ <h3 id="removed">Removed</h3>
 
 <h3 id="fixed">Fixed</h3>
 
+<ul>
+  <li>
+<a href="https://github.com/ruby-oauth/oauth2/pull/690">gh!690</a> - Add yard-fence to handle braces within code fences in markdown properly by @pboling</li>
+</ul>
+
 <h3 id="security">Security</h3>
 
-<h2 id="2017---2025-09-15">
+<h2 id="section">
 <a href="https://github.com/ruby-oauth/oauth2/compare/v2.0.16...v2.0.17">2.0.17</a> - 2025-09-15</h2>
 
 <ul>
@@ -112,10 +121,10 @@ <h3 id="added-1">Added</h3>
 
 <ul>
   <li>
-<a href="https://github.com/ruby-oauth/oauth2/pull/682">gh!682</a> - AccessToken: support Hash-based verb-dependent token transmission mode (e.g., :query, post: :header)</li>
+<a href="https://github.com/ruby-oauth/oauth2/pull/682">gh!682</a> - AccessToken: support Hash-based verb-dependent token transmission mode (e.g., <code>{get: :query, post: :header}</code>)</li>
 </ul>
 
-<h2 id="2016---2025-09-14">
+<h2 id="section-1">
 <a href="https://github.com/ruby-oauth/oauth2/compare/v2.0.15...v2.0.16">2.0.16</a> - 2025-09-14</h2>
 
 <ul>
@@ -157,7 +166,7 @@ <h3 id="changed-1">Changed</h3>
 <a href="https://github.com/ruby-oauth/oauth2/pull/681">gh!681</a> - Upgrade to kettle-dev v1.1.19</li>
 </ul>
 
-<h2 id="2015---2025-09-08">
+<h2 id="section-2">
 <a href="https://github.com/ruby-oauth/oauth2/compare/v2.0.14...v2.0.15">2.0.15</a> - 2025-09-08</h2>
 
 <ul>
@@ -202,7 +211,7 @@ <h3 id="fixed-1">Fixed</h3>
   <li>point badge to the correct workflow for Ruby 2.3 (caboose.yml)</li>
 </ul>
 
-<h2 id="2014---2025-08-31">
+<h2 id="section-3">
 <a href="https://github.com/ruby-oauth/oauth2/compare/v2.0.13...v2.0.14">2.0.14</a> - 2025-08-31</h2>
 
 <ul>
@@ -246,7 +255,7 @@ <h3 id="added-4">Added</h3>
 <a href="https://github.com/ruby-oauth/oauth2/pull/664">gh!664</a> - README: Add example for JHipster UAA (Spring Cloud) password grant, converted from Postman/Net::HTTP by @pboling</li>
 </ul>
 
-<h2 id="2013---2025-08-30">
+<h2 id="section-4">
 <a href="https://github.com/ruby-oauth/oauth2/compare/v2.0.12...v2.0.13">2.0.13</a> - 2025-08-30</h2>
 
 <ul>
@@ -291,7 +300,7 @@ <h3 id="fixed-2">Fixed</h3>
 
 <h3 id="security-1">Security</h3>
 
-<h2 id="2012---2025-05-31">
+<h2 id="section-5">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.11...v2.0.12">2.0.12</a> - 2025-05-31</h2>
 
 <ul>
@@ -332,7 +341,7 @@ <h3 id="fixed-3">Fixed</h3>
   <li>Documentation Typos by @pboling</li>
 </ul>
 
-<h2 id="2011---2025-05-23">
+<h2 id="section-6">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.10...v2.0.11">2.0.11</a> - 2025-05-23</h2>
 
 <ul>
@@ -393,7 +402,7 @@ <h3 id="fixed-4">Fixed</h3>
   <li>Incorrect documentation related to silencing warnings (@pboling)</li>
 </ul>
 
-<h2 id="2010---2025-05-17">
+<h2 id="section-7">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.9...v2.0.10">2.0.10</a> - 2025-05-17</h2>
 
 <ul>
@@ -500,7 +509,7 @@ <h3 id="fixed-5">Fixed</h3>
 <a href="https://github.com/ruby-oauth/oauth2/pull/646">gh!646</a> - Change <code>require</code> to <code>require_relative</code> (improve performance) (@Aboling0)</li>
 </ul>
 
-<h2 id="209---2022-09-16">
+<h2 id="section-8">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.8...v2.0.9">2.0.9</a> - 2022-09-16</h2>
 
 <ul>
@@ -521,7 +530,7 @@ <h3 id="changed-7">Changed</h3>
   <li>Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)</li>
 </ul>
 
-<h2 id="208---2022-09-01">
+<h2 id="section-9">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.7...v2.0.8">2.0.8</a> - 2022-09-01</h2>
 
 <ul>
@@ -544,7 +553,7 @@ <h3 id="added-10">Added</h3>
 </li>
 </ul>
 
-<h2 id="207---2022-08-22">
+<h2 id="section-10">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.6...v2.0.7">2.0.7</a> - 2022-08-22</h2>
 
 <ul>
@@ -572,7 +581,7 @@ <h3 id="fixed-6">Fixed</h3>
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/625">!625</a> - Fixes the printed version in the post install message (@hasghari)</li>
 </ul>
 
-<h2 id="206---2022-07-13">
+<h2 id="section-11">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.5...v2.0.6">2.0.6</a> - 2022-07-13</h2>
 
 <ul>
@@ -587,7 +596,7 @@ <h3 id="fixed-7">Fixed</h3>
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/624">!624</a> - Fixes a <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/623">regression</a> in v2.0.5, where an error would be raised in refresh_token flows due to (legitimate) lack of access_token (@pboling)</li>
 </ul>
 
-<h2 id="205---2022-07-07">
+<h2 id="section-12">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.4...v2.0.5">2.0.5</a> - 2022-07-07</h2>
 
 <ul>
@@ -617,7 +626,7 @@ <h3 id="fixed-8">Fixed</h3>
   </li>
 </ul>
 
-<h2 id="204---2022-07-01">
+<h2 id="section-13">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.3...v2.0.4">2.0.4</a> - 2022-07-01</h2>
 
 <ul>
@@ -632,7 +641,7 @@ <h3 id="fixed-9">Fixed</h3>
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/618">!618</a> - In some scenarios the <code>snaky</code> option default value was not applied (@pboling)</li>
 </ul>
 
-<h2 id="203---2022-06-28">
+<h2 id="section-14">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.2...v2.0.3">2.0.3</a> - 2022-06-28</h2>
 
 <ul>
@@ -658,7 +667,7 @@ <h3 id="fixed-10">Fixed</h3>
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/615">!615</a> - Fix support for requests with blocks, see <code>Faraday::Connection#run_request</code> (@pboling)</li>
 </ul>
 
-<h2 id="202---2022-06-24">
+<h2 id="section-15">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.1...v2.0.2">2.0.2</a> - 2022-06-24</h2>
 
 <ul>
@@ -677,7 +686,7 @@ <h3 id="fixed-11">Fixed</h3>
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/607">!607</a> - CHANGELOG correction, reference to <code>OAuth2::ConnectionError</code> (@zavan)</li>
 </ul>
 
-<h2 id="201---2022-06-22">
+<h2 id="section-16">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.0...v2.0.1">2.0.1</a> - 2022-06-22</h2>
 
 <ul>
@@ -692,7 +701,7 @@ <h3 id="added-13">Added</h3>
   <li>Increased test coverage to 99% (@pboling)</li>
 </ul>
 
-<h2 id="200---2022-06-21">
+<h2 id="section-17">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.11...v2.0.0">2.0.0</a> - 2022-06-21</h2>
 
 <ul>
@@ -850,7 +859,7 @@ <h3 id="removed-1">Removed</h3>
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/590">!590</a> - <em>Dependency</em>: Removed <code>multi_json</code> (@stanhu)</li>
 </ul>
 
-<h2 id="1411---2022-09-16">
+<h2 id="section-18">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.10...v1.4.11">1.4.11</a> - 2022-09-16</h2>
 
 <ul>
@@ -860,7 +869,7 @@ <h2 id="1411---2022-09-16">
   <li>Complete migration to Gitlab, updating all links, and references in VCS-managed files (@pboling)</li>
 </ul>
 
-<h2 id="1410---2022-07-01">
+<h2 id="section-19">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.9...v1.4.10">1.4.10</a> - 2022-07-01</h2>
 
 <ul>
@@ -869,7 +878,7 @@ <h2 id="1410---2022-07-01">
   <li>FIPS Compatibility <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/587">!587</a> (@akostadinov)</li>
 </ul>
 
-<h2 id="149---2022-02-20">
+<h2 id="section-20">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.8...v1.4.9">1.4.9</a> - 2022-02-20</h2>
 
 <ul>
@@ -887,7 +896,7 @@ <h2 id="149---2022-02-20">
   <li>Add Windows and MacOS to test matrix</li>
 </ul>
 
-<h2 id="148---2022-02-18">
+<h2 id="section-21">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.7...v1.4.8">1.4.8</a> - 2022-02-18</h2>
 
 <ul>
@@ -904,7 +913,7 @@ <h2 id="148---2022-02-18">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/543">!543</a> - Support for more modern Open SSL libraries (@pboling)</li>
 </ul>
 
-<h2 id="147---2021-03-19">
+<h2 id="section-22">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.6...v1.4.7">1.4.7</a> - 2021-03-19</h2>
 
 <ul>
@@ -914,7 +923,7 @@ <h2 id="147---2021-03-19">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/541">!541</a> - Backport fix to expires_at handling <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/533">!533</a> to 1-4-stable branch. (@dobon)</li>
 </ul>
 
-<h2 id="146---2021-03-19">
+<h2 id="section-23">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.5...v1.4.6">1.4.6</a> - 2021-03-19</h2>
 
 <ul>
@@ -928,7 +937,7 @@ <h2 id="146---2021-03-19">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/538">!538</a> - Remove reliance on globally included OAuth2 in tests, analogous to <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/539">!539</a> on main branch (@anderscarling)</li>
 </ul>
 
-<h2 id="145---2021-03-18">
+<h2 id="section-24">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.4...v1.4.5">1.4.5</a> - 2021-03-18</h2>
 
 <ul>
@@ -944,7 +953,7 @@ <h2 id="145---2021-03-18">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/500">!500</a> - Fix YARD documentation formatting (@olleolleolle)</li>
 </ul>
 
-<h2 id="144---2020-02-12">
+<h2 id="section-25">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.3...v1.4.4">1.4.4</a> - 2020-02-12</h2>
 
 <ul>
@@ -954,7 +963,7 @@ <h2 id="144---2020-02-12">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/408">!408</a> - Fixed expires_at for formatted time (@Lomey)</li>
 </ul>
 
-<h2 id="143---2020-01-29">
+<h2 id="section-26">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.2...v1.4.3">1.4.3</a> - 2020-01-29</h2>
 
 <ul>
@@ -972,7 +981,7 @@ <h2 id="143---2020-01-29">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests/433">!433</a> - allow field names with square brackets and numbers in params (@asm256)</li>
 </ul>
 
-<h2 id="142---2019-10-01">
+<h2 id="section-27">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.1...v1.4.2">1.4.2</a> - 2019-10-01</h2>
 
 <ul>
@@ -986,7 +995,7 @@ <h2 id="142---2019-10-01">
   </li>
 </ul>
 
-<h2 id="141---2018-10-13">
+<h2 id="section-28">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.0...v1.4.1">1.4.1</a> - 2018-10-13</h2>
 
 <ul>
@@ -1030,7 +1039,7 @@ <h2 id="141---2018-10-13">
   </li>
 </ul>
 
-<h2 id="140---2017-06-09">
+<h2 id="section-29">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.3.1...v1.4.0">1.4.0</a> - 2017-06-09</h2>
 
 <ul>
@@ -1044,7 +1053,7 @@ <h2 id="140---2017-06-09">
 <em>Dependency</em>: Upgrade Faraday to 0.12 (@sferik)</li>
 </ul>
 
-<h2 id="131---2017-03-03">
+<h2 id="section-30">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.3.0...v1.3.1">1.3.1</a> - 2017-03-03</h2>
 
 <ul>
@@ -1055,7 +1064,7 @@ <h2 id="131---2017-03-03">
 <em>Dependency</em>: Upgrade Faraday to Faraday 0.11 (@mcfiredrill, @rhymes, @pschambacher)</li>
 </ul>
 
-<h2 id="130---2016-12-28">
+<h2 id="section-31">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.2.0...v1.3.0">1.3.0</a> - 2016-12-28</h2>
 
 <ul>
@@ -1071,7 +1080,7 @@ <h2 id="130---2016-12-28">
   <li>Add support for Faraday 0.10 (@rhymes)</li>
 </ul>
 
-<h2 id="120---2016-07-01">
+<h2 id="section-32">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.1.0...v1.2.0">1.2.0</a> - 2016-07-01</h2>
 
 <ul>
@@ -1082,7 +1091,7 @@ <h2 id="120---2016-07-01">
   <li>Use <code>raise</code> rather than <code>fail</code> to throw exceptions (@sferik)</li>
 </ul>
 
-<h2 id="110---2016-01-30">
+<h2 id="section-33">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.0.0...v1.1.0">1.1.0</a> - 2016-01-30</h2>
 
 <ul>
@@ -1092,7 +1101,7 @@ <h2 id="110---2016-01-30">
   <li>Add support for Rack 2, and bump various other dependencies (@sferik)</li>
 </ul>
 
-<h2 id="100---2014-07-09">
+<h2 id="section-34">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.9.4...v1.0.0">1.0.0</a> - 2014-07-09</h2>
 
 <ul>
@@ -1112,7 +1121,7 @@ <h3 id="fixed-13">Fixed</h3>
   <li>Fix Base64.strict_encode64 incompatibility with Ruby 1.8.7.</li>
 </ul>
 
-<h2 id="050---2011-07-29">
+<h2 id="section-35">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.4.1...v0.5.0">0.5.0</a> - 2011-07-29</h2>
 
 <ul>
@@ -1135,7 +1144,7 @@ <h3 id="changed-10">Changed</h3>
 <em>breaking</em> <code>web_server</code> renamed to <code>auth_code</code>.</li>
 </ul>
 
-<h2 id="041---2011-04-20">
+<h2 id="section-36">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.4.0...v0.4.1">0.4.1</a> - 2011-04-20</h2>
 
 <ul>
@@ -1143,7 +1152,7 @@ <h2 id="041---2011-04-20">
 </li>
 </ul>
 
-<h2 id="040---2011-04-20">
+<h2 id="section-37">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.3.0...v0.4.0">0.4.0</a> - 2011-04-20</h2>
 
 <ul>
@@ -1151,7 +1160,7 @@ <h2 id="040---2011-04-20">
 </li>
 </ul>
 
-<h2 id="030---2011-04-08">
+<h2 id="section-38">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.2.0...v0.3.0">0.3.0</a> - 2011-04-08</h2>
 
 <ul>
@@ -1159,7 +1168,7 @@ <h2 id="030---2011-04-08">
 </li>
 </ul>
 
-<h2 id="020---2011-04-01">
+<h2 id="section-39">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.1.1...v0.2.0">0.2.0</a> - 2011-04-01</h2>
 
 <ul>
@@ -1167,7 +1176,7 @@ <h2 id="020---2011-04-01">
 </li>
 </ul>
 
-<h2 id="011---2011-01-12">
+<h2 id="section-40">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.1.0...v0.1.1">0.1.1</a> - 2011-01-12</h2>
 
 <ul>
@@ -1175,7 +1184,7 @@ <h2 id="011---2011-01-12">
 </li>
 </ul>
 
-<h2 id="010---2010-10-13">
+<h2 id="section-41">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.13...v0.1.0">0.1.0</a> - 2010-10-13</h2>
 
 <ul>
@@ -1183,7 +1192,7 @@ <h2 id="010---2010-10-13">
 </li>
 </ul>
 
-<h2 id="0013---2010-08-17">
+<h2 id="section-42">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.12...v0.0.13">0.0.13</a> - 2010-08-17</h2>
 
 <ul>
@@ -1191,7 +1200,7 @@ <h2 id="0013---2010-08-17">
 </li>
 </ul>
 
-<h2 id="0012---2010-08-17">
+<h2 id="section-43">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.11...v0.0.12">0.0.12</a> - 2010-08-17</h2>
 
 <ul>
@@ -1199,7 +1208,7 @@ <h2 id="0012---2010-08-17">
 </li>
 </ul>
 
-<h2 id="0011---2010-08-17">
+<h2 id="section-44">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.10...v0.0.11">0.0.11</a> - 2010-08-17</h2>
 
 <ul>
@@ -1207,7 +1216,7 @@ <h2 id="0011---2010-08-17">
 </li>
 </ul>
 
-<h2 id="0010---2010-06-19">
+<h2 id="section-45">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.9...v0.0.10">0.0.10</a> - 2010-06-19</h2>
 
 <ul>
@@ -1215,7 +1224,7 @@ <h2 id="0010---2010-06-19">
 </li>
 </ul>
 
-<h2 id="009---2010-06-18">
+<h2 id="section-46">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.8...v0.0.9">0.0.9</a> - 2010-06-18</h2>
 
 <ul>
@@ -1223,7 +1232,7 @@ <h2 id="009---2010-06-18">
 </li>
 </ul>
 
-<h2 id="008---2010-04-27">
+<h2 id="section-47">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.7...v0.0.8">0.0.8</a> - 2010-04-27</h2>
 
 <ul>
@@ -1231,7 +1240,7 @@ <h2 id="008---2010-04-27">
 </li>
 </ul>
 
-<h2 id="007---2010-04-27">
+<h2 id="section-48">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.6...v0.0.7">0.0.7</a> - 2010-04-27</h2>
 
 <ul>
@@ -1239,7 +1248,7 @@ <h2 id="007---2010-04-27">
 </li>
 </ul>
 
-<h2 id="006---2010-04-25">
+<h2 id="section-49">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.5...v0.0.6">0.0.6</a> - 2010-04-25</h2>
 
 <ul>
@@ -1247,7 +1256,7 @@ <h2 id="006---2010-04-25">
 </li>
 </ul>
 
-<h2 id="005---2010-04-23">
+<h2 id="section-50">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.4...v0.0.5">0.0.5</a> - 2010-04-23</h2>
 
 <ul>
@@ -1255,7 +1264,7 @@ <h2 id="005---2010-04-23">
 </li>
 </ul>
 
-<h2 id="004---2010-04-22">
+<h2 id="section-51">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.3...v0.0.4">0.0.4</a> - 2010-04-22</h2>
 
 <ul>
@@ -1263,7 +1272,7 @@ <h2 id="004---2010-04-22">
 </li>
 </ul>
 
-<h2 id="003---2010-04-22">
+<h2 id="section-52">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.2...v0.0.3">0.0.3</a> - 2010-04-22</h2>
 
 <ul>
@@ -1271,7 +1280,7 @@ <h2 id="003---2010-04-22">
 </li>
 </ul>
 
-<h2 id="002---2010-04-22">
+<h2 id="section-53">
 <a href="https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.1...v0.0.2">0.0.2</a> - 2010-04-22</h2>
 
 <ul>
@@ -1279,7 +1288,7 @@ <h2 id="002---2010-04-22">
 </li>
 </ul>
 
-<h2 id="001---2010-04-22">
+<h2 id="section-54">
 <a href="https://github.com/ruby-oauth/oauth2/compare/311d9f4...v0.0.1">0.0.1</a> - 2010-04-22</h2>
 
 <ul>
@@ -1290,9 +1299,9 @@ <h2 id="001---2010-04-22">
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.CITATION.html b/docs/file.CITATION.html
index 6667e4a7..ec687c30 100644
--- a/docs/file.CITATION.html
+++ b/docs/file.CITATION.html
@@ -57,34 +57,32 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>cff-version: 1.2.0<br>
-title: oauth2<br>
-message: &gt;-<br>
-  If you use this work and you want to cite it,<br>
-  then you can use the metadata from this file.<br>
-type: software<br>
-authors:</p>
-<ul>
-  <li>given-names: Peter Hurn<br>
-family-names: Boling<br>
-email: peter@railsbling.com<br>
-affiliation: railsbling.com<br>
-orcid: ‘https://orcid.org/0009-0008-8519-441X’<br>
-identifiers:</li>
-  <li>type: url<br>
-value: ‘https://github.com/ruby-oauth/oauth2’<br>
-description: oauth2<br>
-repository-code: ‘https://github.com/ruby-oauth/oauth2’<br>
-abstract: &gt;-<br>
-  oauth2<br>
-license: See license file</li>
-</ul>
+      <div id="content"><div id='filecontents'><p>cff-version: 1.2.0
+title: oauth2
+message: &gt;-
+  If you use this work and you want to cite it,
+  then you can use the metadata from this file.
+type: software
+authors:
+  - given-names: Peter Hurn
+    family-names: Boling
+    email: peter@railsbling.com
+    affiliation: railsbling.com
+    orcid: ‘https://orcid.org/0009-0008-8519-441X’
+identifiers:
+  - type: url
+    value: ‘https://github.com/ruby-oauth/oauth2’
+    description: oauth2
+repository-code: ‘https://github.com/ruby-oauth/oauth2’
+abstract: &gt;-
+  oauth2
+license: See license file</p>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.CODE_OF_CONDUCT.html b/docs/file.CODE_OF_CONDUCT.html
index 4e34bb2e..818acbd7 100644
--- a/docs/file.CODE_OF_CONDUCT.html
+++ b/docs/file.CODE_OF_CONDUCT.html
@@ -61,139 +61,139 @@
 
 <h2 id="our-pledge">Our Pledge</h2>
 
-<p>We as members, contributors, and leaders pledge to make participation in our<br>
-community a harassment-free experience for everyone, regardless of age, body<br>
-size, visible or invisible disability, ethnicity, sex characteristics, gender<br>
-identity and expression, level of experience, education, socio-economic status,<br>
-nationality, personal appearance, race, caste, color, religion, or sexual<br>
+<p>We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
 identity and orientation.</p>
 
-<p>We pledge to act and interact in ways that contribute to an open, welcoming,<br>
+<p>We pledge to act and interact in ways that contribute to an open, welcoming,
 diverse, inclusive, and healthy community.</p>
 
 <h2 id="our-standards">Our Standards</h2>
 
-<p>Examples of behavior that contributes to a positive environment for our<br>
+<p>Examples of behavior that contributes to a positive environment for our
 community include:</p>
 
 <ul>
   <li>Demonstrating empathy and kindness toward other people</li>
   <li>Being respectful of differing opinions, viewpoints, and experiences</li>
   <li>Giving and gracefully accepting constructive feedback</li>
-  <li>Accepting responsibility and apologizing to those affected by our mistakes,<br>
+  <li>Accepting responsibility and apologizing to those affected by our mistakes,
 and learning from the experience</li>
-  <li>Focusing on what is best not just for us as individuals, but for the overall<br>
+  <li>Focusing on what is best not just for us as individuals, but for the overall
 community</li>
 </ul>
 
 <p>Examples of unacceptable behavior include:</p>
 
 <ul>
-  <li>The use of sexualized language or imagery, and sexual attention or advances of<br>
+  <li>The use of sexualized language or imagery, and sexual attention or advances of
 any kind</li>
   <li>Trolling, insulting or derogatory comments, and personal or political attacks</li>
   <li>Public or private harassment</li>
-  <li>Publishing others’ private information, such as a physical or email address,<br>
+  <li>Publishing others’ private information, such as a physical or email address,
 without their explicit permission</li>
-  <li>Other conduct which could reasonably be considered inappropriate in a<br>
+  <li>Other conduct which could reasonably be considered inappropriate in a
 professional setting</li>
 </ul>
 
 <h2 id="enforcement-responsibilities">Enforcement Responsibilities</h2>
 
-<p>Community leaders are responsible for clarifying and enforcing our standards of<br>
-acceptable behavior and will take appropriate and fair corrective action in<br>
-response to any behavior that they deem inappropriate, threatening, offensive,<br>
+<p>Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
 or harmful.</p>
 
-<p>Community leaders have the right and responsibility to remove, edit, or reject<br>
-comments, commits, code, wiki edits, issues, and other contributions that are<br>
-not aligned to this Code of Conduct, and will communicate reasons for moderation<br>
+<p>Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
 decisions when appropriate.</p>
 
 <h2 id="scope">Scope</h2>
 
-<p>This Code of Conduct applies within all community spaces, and also applies when<br>
-an individual is officially representing the community in public spaces.<br>
-Examples of representing our community include using an official email address,<br>
-posting via an official social media account, or acting as an appointed<br>
+<p>This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
 representative at an online or offline event.</p>
 
 <h2 id="enforcement">Enforcement</h2>
 
-<p>Instances of abusive, harassing, or otherwise unacceptable behavior may be<br>
-reported to the community leaders responsible for enforcement at<br>
-<a href="http://www.railsbling.com/contact"><img src="https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&amp;logo=rubyonrails&amp;logoColor=red" alt="Contact Maintainer"></a>.<br>
+<p>Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+<a href="http://www.railsbling.com/contact"><img src="https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&amp;logo=rubyonrails&amp;logoColor=red" alt="Contact Maintainer"></a>.
 All complaints will be reviewed and investigated promptly and fairly.</p>
 
-<p>All community leaders are obligated to respect the privacy and security of the<br>
+<p>All community leaders are obligated to respect the privacy and security of the
 reporter of any incident.</p>
 
 <h2 id="enforcement-guidelines">Enforcement Guidelines</h2>
 
-<p>Community leaders will follow these Community Impact Guidelines in determining<br>
+<p>Community leaders will follow these Community Impact Guidelines in determining
 the consequences for any action they deem in violation of this Code of Conduct:</p>
 
-<h3 id="1-correction">1. Correction</h3>
+<h3 id="correction">1. Correction</h3>
 
-<p><strong>Community Impact</strong>: Use of inappropriate language or other behavior deemed<br>
+<p><strong>Community Impact</strong>: Use of inappropriate language or other behavior deemed
 unprofessional or unwelcome in the community.</p>
 
-<p><strong>Consequence</strong>: A private, written warning from community leaders, providing<br>
-clarity around the nature of the violation and an explanation of why the<br>
+<p><strong>Consequence</strong>: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
 behavior was inappropriate. A public apology may be requested.</p>
 
-<h3 id="2-warning">2. Warning</h3>
+<h3 id="warning">2. Warning</h3>
 
-<p><strong>Community Impact</strong>: A violation through a single incident or series of<br>
+<p><strong>Community Impact</strong>: A violation through a single incident or series of
 actions.</p>
 
-<p><strong>Consequence</strong>: A warning with consequences for continued behavior. No<br>
-interaction with the people involved, including unsolicited interaction with<br>
-those enforcing the Code of Conduct, for a specified period of time. This<br>
-includes avoiding interactions in community spaces as well as external channels<br>
-like social media. Violating these terms may lead to a temporary or permanent<br>
+<p><strong>Consequence</strong>: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
 ban.</p>
 
-<h3 id="3-temporary-ban">3. Temporary Ban</h3>
+<h3 id="temporary-ban">3. Temporary Ban</h3>
 
-<p><strong>Community Impact</strong>: A serious violation of community standards, including<br>
+<p><strong>Community Impact</strong>: A serious violation of community standards, including
 sustained inappropriate behavior.</p>
 
-<p><strong>Consequence</strong>: A temporary ban from any sort of interaction or public<br>
-communication with the community for a specified period of time. No public or<br>
-private interaction with the people involved, including unsolicited interaction<br>
-with those enforcing the Code of Conduct, is allowed during this period.<br>
+<p><strong>Consequence</strong>: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
 Violating these terms may lead to a permanent ban.</p>
 
-<h3 id="4-permanent-ban">4. Permanent Ban</h3>
+<h3 id="permanent-ban">4. Permanent Ban</h3>
 
-<p><strong>Community Impact</strong>: Demonstrating a pattern of violation of community<br>
-standards, including sustained inappropriate behavior, harassment of an<br>
+<p><strong>Community Impact</strong>: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
 individual, or aggression toward or disparagement of classes of individuals.</p>
 
-<p><strong>Consequence</strong>: A permanent ban from any sort of public interaction within the<br>
+<p><strong>Consequence</strong>: A permanent ban from any sort of public interaction within the
 community.</p>
 
 <h2 id="attribution">Attribution</h2>
 
-<p>This Code of Conduct is adapted from the <a href="https://www.contributor-covenant.org">Contributor Covenant</a>,<br>
-version 2.1, available at<br>
+<p>This Code of Conduct is adapted from the <a href="https://www.contributor-covenant.org">Contributor Covenant</a>,
+version 2.1, available at
 <a href="https://www.contributor-covenant.org/version/2/1/code_of_conduct.html">https://www.contributor-covenant.org/version/2/1/code_of_conduct.html</a>.</p>
 
-<p>Community Impact Guidelines were inspired by<br>
+<p>Community Impact Guidelines were inspired by
 <a href="https://github.com/mozilla/diversity">Mozilla’s code of conduct enforcement ladder</a>.</p>
 
-<p>For answers to common questions about this code of conduct, see the FAQ at<br>
-<a href="https://www.contributor-covenant.org/faq">https://www.contributor-covenant.org/faq</a>. Translations are available at<br>
+<p>For answers to common questions about this code of conduct, see the FAQ at
+<a href="https://www.contributor-covenant.org/faq">https://www.contributor-covenant.org/faq</a>. Translations are available at
 <a href="https://www.contributor-covenant.org/translations">https://www.contributor-covenant.org/translations</a>.</p>
 
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.CONTRIBUTING.html b/docs/file.CONTRIBUTING.html
index 69803d2c..08f3438c 100644
--- a/docs/file.CONTRIBUTING.html
+++ b/docs/file.CONTRIBUTING.html
@@ -59,8 +59,8 @@
 
       <div id="content"><div id='filecontents'><h1 id="contributing">Contributing</h1>
 
-<p>Bug reports and pull requests are welcome on <a href="https://codeberg.org/ruby-oauth/oauth2">CodeBerg</a>, <a href="https://gitlab.com/ruby-oauth/oauth2/">GitLab</a>, or <a href="https://github.com/ruby-oauth/oauth2">GitHub</a>.<br>
-This project should be a safe, welcoming space for collaboration, so contributors agree to adhere to<br>
+<p>Bug reports and pull requests are welcome on <a href="https://codeberg.org/ruby-oauth/oauth2">CodeBerg</a>, <a href="https://gitlab.com/ruby-oauth/oauth2/">GitLab</a>, or <a href="https://github.com/ruby-oauth/oauth2">GitHub</a>.
+This project should be a safe, welcoming space for collaboration, so contributors agree to adhere to
 the <a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CODE_OF_CONDUCT.md">code of conduct</a>.</p>
 
 <p>To submit a patch, please fork the project, create a patch with tests, and send a pull request.</p>
@@ -85,86 +85,72 @@ <h2 id="help-out">Help out!</h2>
 
 <h2 id="executables-vs-rake-tasks">Executables vs Rake tasks</h2>
 
-<p>Executables shipped by oauth2 can be used with or without generating the binstubs.<br>
-They will work when oauth2 is installed globally (i.e., <code>gem install oauth2</code>) and do not require that oauth2 be in your bundle.</p>
+<p>Executables shipped by dependencies, such as kettle-dev, and stone_checksums, are available
+after running <code>bin/setup</code>. These include:</p>
 
 <ul>
+  <li>gem_checksums</li>
   <li>kettle-changelog</li>
   <li>kettle-commit-msg</li>
-  <li>oauth2-setup</li>
+  <li>kettle-dev-setup</li>
   <li>kettle-dvcs</li>
   <li>kettle-pre-release</li>
   <li>kettle-readme-backers</li>
   <li>kettle-release</li>
 </ul>
 
-<p>However, the rake tasks provided by oauth2 do require oauth2 to be added as a development dependency and loaded in your Rakefile.<br>
-See the full list of rake tasks in head of Rakefile</p>
+<p>There are many Rake tasks available as well. You can see them by running:</p>
 
-<p><strong>Gemfile</strong></p>
-<pre class="code language-ruby"><code class="language-ruby">group :development do
-  gem &quot;oauth2&quot;, require: false
-end
-</code></pre>
-
-<p><strong>Rakefile</strong></p>
-<pre class="code language-ruby"><code class="language-ruby"># Rakefile
-require &quot;oauth2&quot;
-</code></pre>
+<p><code>shell
+bin/rake -T
+</code></p>
 
 <h2 id="environment-variables-for-local-development">Environment Variables for Local Development</h2>
 
 <p>Below are the primary environment variables recognized by stone_checksums (and its integrated tools). Unless otherwise noted, set boolean values to the string “true” to enable.</p>
 
-<p>General/runtime</p>
-<ul>
-  <li>DEBUG: Enable extra internal logging for this library (default: false)</li>
-  <li>REQUIRE_BENCH: Enable <code>require_bench</code> to profile requires (default: false)</li>
-  <li>CI: When set to true, adjusts default rake tasks toward CI behavior</li>
-</ul>
-
-<p>Coverage (kettle-soup-cover / SimpleCov)</p>
-<ul>
-  <li>K_SOUP_COV_DO: Enable coverage collection (default: true in .envrc)</li>
-  <li>K_SOUP_COV_FORMATTERS: Comma-separated list of formatters (html, xml, rcov, lcov, json, tty)</li>
-  <li>K_SOUP_COV_MIN_LINE: Minimum line coverage threshold (integer, e.g., 100)</li>
-  <li>K_SOUP_COV_MIN_BRANCH: Minimum branch coverage threshold (integer, e.g., 100)</li>
-  <li>K_SOUP_COV_MIN_HARD: Fail the run if thresholds are not met (true/false)</li>
-  <li>K_SOUP_COV_MULTI_FORMATTERS: Enable multiple formatters at once (true/false)</li>
-  <li>K_SOUP_COV_OPEN_BIN: Path to browser opener for HTML (empty disables auto-open)</li>
-  <li>MAX_ROWS: Limit console output rows for simplecov-console (e.g., 1)<br>
-Tip: When running a single spec file locally, you may want <code>K_SOUP_COV_MIN_HARD=false</code> to avoid failing thresholds for a partial run.</li>
-</ul>
-
-<p>GitHub API and CI helpers</p>
-<ul>
-  <li>GITHUB_TOKEN or GH_TOKEN: Token used by <code>ci:act</code> and release workflow checks to query GitHub Actions status at higher rate limits</li>
-</ul>
-
-<p>Releasing and signing</p>
-<ul>
-  <li>SKIP_GEM_SIGNING: If set, skip gem signing during build/release</li>
-  <li>GEM_CERT_USER: Username for selecting your public cert in <code>certs/&lt;USER&gt;.pem</code> (defaults to $USER)</li>
-  <li>SOURCE_DATE_EPOCH: Reproducible build timestamp. <code>kettle-release</code> will set this automatically for the session.</li>
-</ul>
-
-<p>Git hooks and commit message helpers (exe/kettle-commit-msg)</p>
-<ul>
-  <li>GIT_HOOK_BRANCH_VALIDATE: Branch name validation mode (e.g., <code>jira</code>) or <code>false</code> to disable</li>
-  <li>GIT_HOOK_FOOTER_APPEND: Append a footer to commit messages when goalie allows (true/false)</li>
-  <li>GIT_HOOK_FOOTER_SENTINEL: Required when footer append is enabled — a unique first-line sentinel to prevent duplicates</li>
-  <li>GIT_HOOK_FOOTER_APPEND_DEBUG: Extra debug output in the footer template (true/false)</li>
-</ul>
+<p>General/runtime
+- DEBUG: Enable extra internal logging for this library (default: false)
+- REQUIRE_BENCH: Enable <code>require_bench</code> to profile requires (default: false)
+- CI: When set to true, adjusts default rake tasks toward CI behavior</p>
+
+<p>Coverage (kettle-soup-cover / SimpleCov)
+- K_SOUP_COV_DO: Enable coverage collection (default: true in .envrc)
+- K_SOUP_COV_FORMATTERS: Comma-separated list of formatters (html, xml, rcov, lcov, json, tty)
+- K_SOUP_COV_MIN_LINE: Minimum line coverage threshold (integer, e.g., 100)
+- K_SOUP_COV_MIN_BRANCH: Minimum branch coverage threshold (integer, e.g., 100)
+- K_SOUP_COV_MIN_HARD: Fail the run if thresholds are not met (true/false)
+- K_SOUP_COV_MULTI_FORMATTERS: Enable multiple formatters at once (true/false)
+- K_SOUP_COV_OPEN_BIN: Path to browser opener for HTML (empty disables auto-open)
+- MAX_ROWS: Limit console output rows for simplecov-console (e.g., 1)
+  Tip: When running a single spec file locally, you may want <code>K_SOUP_COV_MIN_HARD=false</code> to avoid failing thresholds for a partial run.</p>
+
+<p>GitHub API and CI helpers
+- GITHUB_TOKEN or GH_TOKEN: Token used by <code>ci:act</code> and release workflow checks to query GitHub Actions status at higher rate limits</p>
+
+<p>Releasing and signing
+- SKIP_GEM_SIGNING: If set, skip gem signing during build/release
+- GEM_CERT_USER: Username for selecting your public cert in <code>certs/&lt;USER&gt;.pem</code> (defaults to $USER)
+- SOURCE_DATE_EPOCH: Reproducible build timestamp.
+  - <code>kettle-release</code> will set this automatically for the session.
+  - Not needed on bundler &gt;= 2.7.0, as reproducible builds have become the default.</p>
+
+<p>Git hooks and commit message helpers (exe/kettle-commit-msg)
+- GIT_HOOK_BRANCH_VALIDATE: Branch name validation mode (e.g., <code>jira</code>) or <code>false</code> to disable
+- GIT_HOOK_FOOTER_APPEND: Append a footer to commit messages when goalie allows (true/false)
+- GIT_HOOK_FOOTER_SENTINEL: Required when footer append is enabled — a unique first-line sentinel to prevent duplicates
+- GIT_HOOK_FOOTER_APPEND_DEBUG: Extra debug output in the footer template (true/false)</p>
 
 <p>For a quick starting point, this repository’s <code>.envrc</code> shows sane defaults, and <code>.env.local</code> can override them locally.</p>
 
 <h2 id="appraisals">Appraisals</h2>
 
-<p>From time to time the <a href="https://github.com/appraisal-rb/appraisal2">appraisal2</a> gemfiles in <code>gemfiles/</code> will need to be updated.<br>
+<p>From time to time the <a href="https://github.com/appraisal-rb/appraisal2">appraisal2</a> gemfiles in <code>gemfiles/</code> will need to be updated.
 They are created and updated with the commands:</p>
 
-<pre class="code language-console"><code class="language-console">bin/rake appraisal:update
-</code></pre>
+<p><code>console
+bin/rake appraisal:update
+</code></p>
 
 <p>When adding an appraisal to CI, check the <a href="https://github.com/ruby/ruby-builder/releases/tag/toolcache">runner tool cache</a> to see which runner to use.</p>
 
@@ -174,38 +160,40 @@ <h2 id="the-reek-list">The Reek List</h2>
 
 <p>To refresh the <code>reek</code> list:</p>
 
-<pre class="code language-console"><code class="language-console">bundle exec reek &gt; REEK
-</code></pre>
+<p><code>console
+bundle exec reek &gt; REEK
+</code></p>
 
 <h2 id="run-tests">Run Tests</h2>
 
 <p>To run all tests</p>
 
-<pre class="code language-console"><code class="language-console">bundle exec rake test
-</code></pre>
+<p><code>console
+bundle exec rake test
+</code></p>
 
 <h3 id="spec-organization-required">Spec organization (required)</h3>
 
 <ul>
-  <li>One spec file per class/module. For each class or module under <code>lib/</code>, keep all of its unit tests in a single spec file under <code>spec/</code> that mirrors the path and file name exactly: <code>lib/oauth2/release_cli.rb</code> -&gt; <code>spec/oauth2/release_cli_spec.rb</code>.</li>
-  <li>Never add a second spec file for the same class/module. Examples of disallowed names: <code>*_more_spec.rb</code>, <code>*_extra_spec.rb</code>, <code>*_status_spec.rb</code>, or any other suffix that still targets the same class. If you find yourself wanting a second file, merge those examples into the canonical spec file for that class/module.</li>
+  <li>One spec file per class/module. For each class or module under <code>lib/</code>, keep all of its unit tests in a single spec file under <code>spec/</code> that mirrors the path and file name exactly: <code>lib/oauth2/my_class.rb</code> -&gt; <code>spec/oauth2/my_class_spec.rb</code>.</li>
   <li>Exception: Integration specs that intentionally span multiple classes. Place these under <code>spec/integration/</code> (or a clearly named integration folder), and do not directly mirror a single class. Name them after the scenario, not a class.</li>
-  <li>Migration note: If a duplicate spec file exists, move all examples into the canonical file and delete the duplicate. Do not leave stubs or empty files behind.</li>
 </ul>
 
 <h2 id="lint-it">Lint It</h2>
 
 <p>Run all the default tasks, which includes running the gradually autocorrecting linter, <code>rubocop-gradual</code>.</p>
 
-<pre class="code language-console"><code class="language-console">bundle exec rake
-</code></pre>
+<p><code>console
+bundle exec rake
+</code></p>
 
 <p>Or just run the linter.</p>
 
-<pre class="code language-console"><code class="language-console">bundle exec rake rubocop_gradual:autocorrect
-</code></pre>
+<p><code>console
+bundle exec rake rubocop_gradual:autocorrect
+</code></p>
 
-<p>For more detailed information about using RuboCop in this project, please see the <a href="file.RUBOCOP.html" title="RUBOCOP.md">RUBOCOP.md</a> guide. This project uses <code>rubocop_gradual</code> instead of vanilla RuboCop, which requires specific commands for checking violations.</p>
+<p>For more detailed information about using RuboCop in this project, please see the <a href="RUBOCOP.md">RUBOCOP.md</a> guide. This project uses <code>rubocop_gradual</code> instead of vanilla RuboCop, which requires specific commands for checking violations.</p>
 
 <h3 id="important-do-not-add-inline-rubocop-disables">Important: Do not add inline RuboCop disables</h3>
 
@@ -213,7 +201,7 @@ <h3 id="important-do-not-add-inline-rubocop-disables">Important: Do not add inli
 
 <ul>
   <li>Prefer configuration-based exclusions when a rule should not apply to certain paths or files (e.g., via <code>.rubocop.yml</code>).</li>
-  <li>When a violation is temporary and you plan to fix it later, record it in <code>.rubocop_gradual.lock</code> using the gradual workflow:
+  <li>When a violation is temporary, and you plan to fix it later, record it in <code>.rubocop_gradual.lock</code> using the gradual workflow:
     <ul>
       <li>
 <code>bundle exec rake rubocop_gradual:autocorrect</code> (preferred)</li>
@@ -239,10 +227,10 @@ <h2 id="for-maintainers">For Maintainers</h2>
 
 <h3 id="one-time-per-maintainer-setup">One-time, Per-maintainer, Setup</h3>
 
-<p><strong>IMPORTANT</strong>: To sign a build,<br>
-a public key for signing gems will need to be picked up by the line in the<br>
-<code>gemspec</code> defining the <code>spec.cert_chain</code> (check the relevant ENV variables there).<br>
-All releases to RubyGems.org are signed releases.<br>
+<p><strong>IMPORTANT</strong>: To sign a build,
+a public key for signing gems will need to be picked up by the line in the
+<code>gemspec</code> defining the <code>spec.cert_chain</code> (check the relevant ENV variables there).
+All releases are signed releases.
 See: <a href="https://guides.rubygems.org/security/#building-gems">RubyGems Security Guide</a></p>
 
 <p>NOTE: To build without signing the gem set <code>SKIP_GEM_SIGNING</code> to any value in the environment.</p>
@@ -252,9 +240,10 @@ <h3 id="to-release-a-new-version">To release a new version:</h3>
 <h4 id="automated-process">Automated process</h4>
 
 <ol>
-  <li>Update version.rb to contian the correct version-to-be-released.</li>
+  <li>Update version.rb to contain the correct version-to-be-released.</li>
   <li>Run <code>bundle exec kettle-changelog</code>.</li>
   <li>Run <code>bundle exec kettle-release</code>.</li>
+  <li>Stay awake and monitor the release process for any errors, and answer any prompts.</li>
 </ol>
 
 <h4 id="manual-process">Manual process</h4>
@@ -288,8 +277,8 @@ <h4 id="manual-process">Manual process</h4>
   </li>
   <li>Run <code>bundle exec rake build</code>
 </li>
-  <li>Run <code>bin/gem_checksums</code> (more context <a href="https://github.com/rubygems/rubygems/pull/6022">1</a>, <a href="https://github.com/rubygems/guides/pull/325">2</a>)<br>
-to create SHA-256 and SHA-512 checksums. This functionality is provided by the <code>stone_checksums</code><br>
+  <li>Run <code>bin/gem_checksums</code> (more context <a href="https://github.com/rubygems/rubygems/pull/6022">1</a>, <a href="https://github.com/rubygems/guides/pull/325">2</a>)
+to create SHA-256 and SHA-512 checksums. This functionality is provided by the <code>stone_checksums</code>
 <a href="https://github.com/galtzo-floss/stone_checksums">gem</a>.
     <ul>
       <li>The script automatically commits but does not push the checksums</li>
@@ -300,17 +289,16 @@ <h4 id="manual-process">Manual process</h4>
       <li><code>sha256sum pkg/&lt;gem name&gt;-&lt;version&gt;.gem</code></li>
     </ul>
   </li>
-  <li>Run <code>bundle exec rake release</code> which will create a git tag for the version,<br>
-push git commits and tags, and push the <code>.gem</code> file to <a href="https://rubygems.org">rubygems.org</a>
-</li>
+  <li>Run <code>bundle exec rake release</code> which will create a git tag for the version,
+push git commits and tags, and push the <code>.gem</code> file to the gem host configured in the gemspec.</li>
 </ol>
 
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.FUNDING.html b/docs/file.FUNDING.html
index aab97aa9..59b0b074 100644
--- a/docs/file.FUNDING.html
+++ b/docs/file.FUNDING.html
@@ -65,35 +65,30 @@
 
 <p><a href="https://opencollective.com/ruby-oauth#backer"><img src="https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat" alt="OpenCollective Backers"></a> <a href="https://opencollective.com/ruby-oauth#sponsor"><img src="https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat" alt="OpenCollective Sponsors"></a> <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github" alt="Sponsor Me on Github"></a> <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat" alt="Liberapay Goal Progress"></a> <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal" alt="Donate on PayPal"></a></p>
 
-<p><a href="https://www.buymeacoffee.com/pboling"><img src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat" alt="Buy me a coffee"></a> <a href="https://polar.sh/pboling"><img src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat" alt="Donate on Polar"></a> <a href="https://ko-fi.com/O5O86SNP4"><img src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat" alt="Donate to my FLOSS or refugee efforts at ko-fi.com"></a> <a href="https://patreon.com/galtzo"><img src="https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat" alt="Donate to my FLOSS or refugee efforts using Patreon"></a></p>
+<p><a href="https://www.buymeacoffee.com/pboling"><img src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat" alt="Buy me a coffee"></a> <a href="https://polar.sh/pboling"><img src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat" alt="Donate on Polar"></a> <a href="https://ko-fi.com/O5O86SNP4"><img src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat" alt="Donate to my FLOSS efforts at ko-fi.com"></a> <a href="https://patreon.com/galtzo"><img src="https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat" alt="Donate to my FLOSS efforts using Patreon"></a></p>
 
 <!-- RELEASE-NOTES-FOOTER-END -->
 
-<h1 id="-request-for-help">🤑 Request for Help</h1>
+<h1 id="a-request-for-help">🤑 A request for help</h1>
 
-<p>Maintainers have teeth and need to pay their dentists.<br>
-After getting laid off in an RIF in March and filled with many dozens of rejections,<br>
-I’m now spending ~60+ hours a week building open source tools.<br>
-I’m hoping to be able to pay for my kids’ health insurance this month,<br>
-so if you value the work I am doing, I need your support.<br>
+<p>Maintainers have teeth and need to pay their dentists.
+After getting laid off in an RIF in March, and encountering difficulty finding a new one,
+I began spending most of my time building open source tools.
+I’m hoping to be able to pay for my kids’ health insurance this month,
+so if you value the work I am doing, I need your support.
 Please consider sponsoring me or the project.</p>
 
 <p>To join the community or get help 👇️ Join the Discord.</p>
 
 <p><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge" alt="Live Chat on Discord"></a></p>
 
-<p>To say “thanks for maintaining such a great tool” ☝️ Join the Discord or 👇️ send money.</p>
+<p>To say “thanks!” ☝️ Join the Discord or 👇️ send money.</p>
 
-<p><a href="https://opencollective.com/ruby-oauth"><img src="https://img.shields.io/opencollective/all/ruby-oauth?style=for-the-badge" alt="Sponsor ruby-oauth/oauth2 on Open Source Collective"></a> 💌 <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&amp;logo=github" alt="Sponsor me on GitHub Sponsors"></a> 💌 <a href="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat"><img src="https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&amp;logo=liberapay&amp;color=a51611" alt="Sponsor me on Liberapay"></a> 💌 <a href="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&amp;logo=paypal&amp;color=0A0A0A" alt="Donate on PayPal"></a></p>
+<p><a href="https://opencollective.com/ruby-oauth"><img src="https://img.shields.io/opencollective/all/ruby-oauth?style=for-the-badge" alt="Sponsor ruby-oauth/oauth2 on Open Source Collective"></a> 💌 <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&amp;logo=github" alt="Sponsor me on GitHub Sponsors"></a> 💌 <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&amp;logo=liberapay&amp;color=a51611" alt="Sponsor me on Liberapay"></a> 💌 <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&amp;logo=paypal&amp;color=0A0A0A" alt="Donate on PayPal"></a></p>
 
 <h1 id="another-way-to-support-open-source-software">Another Way to Support Open Source Software</h1>
 
-<blockquote>
-  <p>How wonderful it is that nobody need wait a single moment before starting to improve the world.<br><br>
-—Anne Frank</p>
-</blockquote>
-
-<p>I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions — totaling 79 hours of FLOSS coding over just the past seven days, a pretty regular week for me.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).</p>
+<p>I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).</p>
 
 <p>If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in <code>bundle fund</code>.</p>
 
@@ -104,9 +99,9 @@ <h1 id="another-way-to-support-open-source-software">Another Way to Support Open
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.IRP.html b/docs/file.IRP.html
index b2fb8145..6664d497 100644
--- a/docs/file.IRP.html
+++ b/docs/file.IRP.html
@@ -180,13 +180,11 @@ <h2 id="legal--regulatory">Legal &amp; regulatory</h2>
 </ul>
 
 <h2 id="retrospective--continuous-improvement">Retrospective &amp; continuous improvement</h2>
-<p>After an incident, perform a brief post-incident review covering:</p>
-<ul>
-  <li>What happened and why</li>
-  <li>What was done to contain and remediate</li>
-  <li>What tests or process changes will prevent recurrence</li>
-  <li>Assign owners and deadlines for follow-up tasks</li>
-</ul>
+<p>After an incident, perform a brief post-incident review covering:
+- What happened and why
+- What was done to contain and remediate
+- What tests or process changes will prevent recurrence
+- Assign owners and deadlines for follow-up tasks</p>
 
 <h2 id="references">References</h2>
 <ul>
@@ -194,26 +192,20 @@ <h2 id="references">References</h2>
 </ul>
 
 <h2 id="appendix-example-checklist-for-an-incident">Appendix: Example checklist for an incident</h2>
-<ul class="task-list">
-  <li class="task-list-item">
-<input type="checkbox" class="task-list-item-checkbox" disabled>Acknowledge report to reporter (24-72 hours)</li>
-  <li class="task-list-item">
-<input type="checkbox" class="task-list-item-checkbox" disabled>Reproduce and classify severity</li>
-  <li class="task-list-item">
-<input type="checkbox" class="task-list-item-checkbox" disabled>Prepare and test a fix in a branch</li>
-  <li class="task-list-item">
-<input type="checkbox" class="task-list-item-checkbox" disabled>Coordinate disclosure via Tidelift</li>
-  <li class="task-list-item">
-<input type="checkbox" class="task-list-item-checkbox" disabled>Publish patch release and advisory</li>
-  <li class="task-list-item">
-<input type="checkbox" class="task-list-item-checkbox" disabled>Postmortem and follow-up actions</li>
+<ul>
+  <li>[ ] Acknowledge report to reporter (24-72 hours)</li>
+  <li>[ ] Reproduce and classify severity</li>
+  <li>[ ] Prepare and test a fix in a branch</li>
+  <li>[ ] Coordinate disclosure via Tidelift</li>
+  <li>[ ] Publish patch release and advisory</li>
+  <li>[ ] Postmortem and follow-up actions</li>
 </ul>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.LICENSE.html b/docs/file.LICENSE.html
index db020c50..428dfecc 100644
--- a/docs/file.LICENSE.html
+++ b/docs/file.LICENSE.html
@@ -60,9 +60,9 @@
       <div id="content"><div id='filecontents'>MIT License<br><br>Copyright (c) 2017-2025 Peter H. Boling, of Galtzo.com, and oauth2 contributors<br>Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.<br><br>Permission is hereby granted, free of charge, to any person obtaining a copy<br>of this software and associated documentation files (the "Software"), to deal<br>in the Software without restriction, including without limitation the rights<br>to use, copy, modify, merge, publish, distribute, sublicense, and/or sell<br>copies of the Software, and to permit persons to whom the Software is<br>furnished to do so, subject to the following conditions:<br><br>The above copyright notice and this permission notice shall be included in all<br>copies or substantial portions of the Software.<br><br>THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR<br>IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,<br>FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE<br>AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER<br>LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,<br>OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE<br>SOFTWARE.</div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.OIDC.html b/docs/file.OIDC.html
index 60f480af..e73faa29 100644
--- a/docs/file.OIDC.html
+++ b/docs/file.OIDC.html
@@ -81,6 +81,7 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 <p>This document complements the inline documentation by focusing on OpenID Connect (OIDC) 1.0 usage patterns when using this gem as an OAuth 2.0 client library.</p>
 
 <p>Scope of this document</p>
+
 <ul>
   <li>Audience: Developers building an OAuth 2.0/OIDC Relying Party (RP, aka client) in Ruby.</li>
   <li>Non-goals: This gem does not implement an OIDC Provider (OP, aka Authorization Server); for OP/server see other projects (e.g., doorkeeper + oidc extensions).</li>
@@ -88,6 +89,7 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 </ul>
 
 <p>Key concepts refresher</p>
+
 <ul>
   <li>OAuth 2.0 delegates authorization; it does not define authentication of the end-user.</li>
   <li>OIDC layers an identity layer on top of OAuth 2.0, introducing:
@@ -101,6 +103,7 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 </ul>
 
 <p>What this gem provides for OIDC</p>
+
 <ul>
   <li>All OAuth 2.0 client capabilities required for OIDC flows: building authorization requests, exchanging authorization codes, refreshing tokens, and making authenticated resource requests.</li>
   <li>Transport and parsing conveniences (snaky hash, Faraday integration, error handling, etc.).</li>
@@ -115,12 +118,13 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 </ul>
 
 <p>What you must add in your app for OIDC</p>
+
 <ul>
-  <li>ID Token validation: This gem surfaces id_token values but does not verify them. Your app should:<br>
-1) Parse the JWT (header, payload, signature)<br>
-2) Fetch the OP JSON Web Key Set (JWKS) from discovery (or configure statically)<br>
-3) Select the correct key by kid (when present) and verify the signature and algorithm<br>
-4) Validate standard claims (iss, aud, exp, iat, nbf, azp, nonce when used, at_hash/c_hash when applicable)<br>
+  <li>ID Token validation: This gem surfaces id_token values but does not verify them. Your app should:
+1) Parse the JWT (header, payload, signature)
+2) Fetch the OP JSON Web Key Set (JWKS) from discovery (or configure statically)
+3) Select the correct key by kid (when present) and verify the signature and algorithm
+4) Validate standard claims (iss, aud, exp, iat, nbf, azp, nonce when used, at_hash/c_hash when applicable)
 5) Enforce expected client_id, issuer, and clock skew policies</li>
   <li>Nonce handling for Authorization Code flow with OIDC: generate a cryptographically-random nonce, bind it to the user session before redirect, include it in authorize request, and verify it in the ID Token on return.</li>
   <li>PKCE is best practice and often required by OPs: generate/verifier, send challenge in authorize, send verifier in token request.</li>
@@ -129,85 +133,88 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 
 <p>Minimal OIDC Authorization Code example</p>
 
-<pre class="code language-ruby"><code class="language-ruby">require &quot;oauth2&quot;
-require &quot;jwt&quot;         # jwt/ruby-jwt
-require &quot;net/http&quot;
-require &quot;json&quot;
-
-client = OAuth2::Client.new(
-  ENV.fetch(&quot;OIDC_CLIENT_ID&quot;),
-  ENV.fetch(&quot;OIDC_CLIENT_SECRET&quot;),
-  site: ENV.fetch(&quot;OIDC_ISSUER&quot;),              # e.g. https://accounts.example.com
-  authorize_url: &quot;/authorize&quot;,                 # or discovered
-  token_url: &quot;/token&quot;,                         # or discovered
-)
-
-# Step 1: Redirect to OP for consent/auth
-state = SecureRandom.hex(16)
+<p>```ruby
+require “oauth2”
+require “jwt”         # jwt/ruby-jwt
+require “net/http”
+require “json”</p>
+
+<p>client = OAuth2::Client.new(
+  ENV.fetch(“OIDC_CLIENT_ID”),
+  ENV.fetch(“OIDC_CLIENT_SECRET”),
+  site: ENV.fetch(“OIDC_ISSUER”),              # e.g. https://accounts.example.com
+  authorize_url: “/authorize”,                 # or discovered
+  token_url: “/token”,                         # or discovered
+)</p>
+
+<h1 id="step-1-redirect-to-op-for-consentauth">Step 1: Redirect to OP for consent/auth</h1>
+<p>state = SecureRandom.hex(16)
 nonce = SecureRandom.hex(16)
 pkce_verifier = SecureRandom.urlsafe_base64(64)
-pkce_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(pkce_verifier)).delete(&quot;=&quot;)
+pkce_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(pkce_verifier)).delete(“=”)</p>
 
-authz_url = client.auth_code.authorize_url(
-  scope: &quot;openid profile email&quot;,
+<p>authz_url = client.auth_code.authorize_url(
+  scope: “openid profile email”,
   state: state,
   nonce: nonce,
   code_challenge: pkce_challenge,
-  code_challenge_method: &quot;S256&quot;,
-  redirect_uri: ENV.fetch(&quot;OIDC_REDIRECT_URI&quot;),
+  code_challenge_method: “S256”,
+  redirect_uri: ENV.fetch(“OIDC_REDIRECT_URI”),
 )
-# redirect_to authz_url
+# redirect_to authz_url</p>
 
-# Step 2: Handle callback
-# params[:code], params[:state]
-raise &quot;state mismatch&quot; unless params[:state] == state
+<h1 id="step-2-handle-callback">Step 2: Handle callback</h1>
+<p># params[:code], params[:state]
+raise “state mismatch” unless params[:state] == state</p>
 
-token = client.auth_code.get_token(
+<p>token = client.auth_code.get_token(
   params[:code],
-  redirect_uri: ENV.fetch(&quot;OIDC_REDIRECT_URI&quot;),
+  redirect_uri: ENV.fetch(“OIDC_REDIRECT_URI”),
   code_verifier: pkce_verifier,
-)
+)</p>
 
-# The token may include: access_token, id_token, refresh_token, etc.
-id_token = token.params[&quot;id_token&quot;] || token.params[:id_token]
+<h1 id="the-token-may-include-accesstoken-idtoken-refreshtoken-etc">The token may include: access_token, id_token, refresh_token, etc.</h1>
+<p>id_token = token.params[“id_token”] || token.params[:id_token]</p>
 
-# Step 3: Validate the ID Token (simplified – add your own checks!)
-# Discover keys (example using .well-known)
-issuer = ENV.fetch(&quot;OIDC_ISSUER&quot;)
-jwks_uri = JSON.parse(Net::HTTP.get(URI.join(issuer, &quot;/.well-known/openid-configuration&quot;))).
-  fetch(&quot;jwks_uri&quot;)
+<h1 id="step-3-validate-the-id-token-simplified--add-your-own-checks">Step 3: Validate the ID Token (simplified – add your own checks!)</h1>
+<p># Discover keys (example using .well-known)
+issuer = ENV.fetch(“OIDC_ISSUER”)
+jwks_uri = JSON.parse(Net::HTTP.get(URI.join(issuer, “/.well-known/openid-configuration”))).
+  fetch(“jwks_uri”)
 jwks = JSON.parse(Net::HTTP.get(URI(jwks_uri)))
-keys = jwks.fetch(&quot;keys&quot;)
+keys = jwks.fetch(“keys”)</p>
 
-# Use ruby-jwt JWK loader
-jwk_set = JWT::JWK::Set.new(keys.map { |k| JWT::JWK.import(k) })
+<h1 id="use-ruby-jwt-jwk-loader">Use ruby-jwt JWK loader</h1>
+<p>jwk_set = JWT::JWK::Set.new(keys.map { |k| JWT::JWK.import(k) })</p>
 
-decoded, headers = JWT.decode(
+<p>decoded, headers = JWT.decode(
   id_token,
   nil,
   true,
-  algorithms: [&quot;RS256&quot;, &quot;ES256&quot;, &quot;PS256&quot;],
+  algorithms: [“RS256”, “ES256”, “PS256”],
   jwks: jwk_set,
   verify_iss: true,
   iss: issuer,
   verify_aud: true,
-  aud: ENV.fetch(&quot;OIDC_CLIENT_ID&quot;),
-)
+  aud: ENV.fetch(“OIDC_CLIENT_ID”),
+)</p>
 
-# Verify nonce
-raise &quot;nonce mismatch&quot; unless decoded[&quot;nonce&quot;] == nonce
+<h1 id="verify-nonce">Verify nonce</h1>
+<p>raise “nonce mismatch” unless decoded[“nonce”] == nonce</p>
 
-# Optionally: call UserInfo
-userinfo = token.get(&quot;/userinfo&quot;).parsed
-</code></pre>
+<h1 id="optionally-call-userinfo">Optionally: call UserInfo</h1>
+<p>userinfo = token.get(“/userinfo”).parsed
+```</p>
 
 <p>Notes on discovery and registration</p>
+
 <ul>
-  <li>Discovery: Most OPs publish configuration at issuer/.well-known/openid-configuration (OIDC Discovery 1.0). From there, resolve authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, etc.</li>
+  <li>Discovery: Most OPs publish configuration at <code>{issuer}/.well-known/openid-configuration</code> (OIDC Discovery 1.0). From there, resolve authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, etc.</li>
   <li>Dynamic Client Registration: Some OPs allow registering clients programmatically (OIDC Dynamic Client Registration 1.0). This gem does not implement registration; use a plain HTTP client or Faraday and store credentials securely.</li>
 </ul>
 
 <p>Common pitfalls and tips</p>
+
 <ul>
   <li>Always request the openid scope when you expect an ID Token. Without it, the OP may behave as vanilla OAuth 2.0.</li>
   <li>Validate ID Token signature and claims before trusting any identity data. Do not rely solely on the presence of an id_token field.</li>
@@ -218,6 +225,7 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 </ul>
 
 <p>Relevant specifications and references</p>
+
 <ul>
   <li>OpenID Connect Core 1.0: https://openid.net/specs/openid-connect-core-1_0.html</li>
   <li>OIDC Core (final): https://openid.net/specs/openid-connect-core-1_0-final.html</li>
@@ -234,6 +242,7 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 </ul>
 
 <p>See also</p>
+
 <ul>
   <li>README sections on OAuth 2.1 notes and OIDC notes</li>
   <li>Strategy classes under lib/oauth2/strategy for flow helpers</li>
@@ -241,15 +250,16 @@ <h2 id="raw-oidc-with-ruby-oauthoauth2">Raw OIDC with ruby-oauth/oauth2</h2>
 </ul>
 
 <p>Contributions welcome</p>
+
 <ul>
   <li>If you discover provider-specific nuances, consider contributing examples or clarifications (without embedding provider-specific hacks into the library).</li>
 </ul>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.README.html b/docs/file.README.html
index 1801f9bb..f103d44c 100644
--- a/docs/file.README.html
+++ b/docs/file.README.html
@@ -57,13 +57,53 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p><a href="https://discord.gg/3qme4XHNKN"><img src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg" alt="Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0"></a> <a href="https://www.ruby-lang.org/"><img src="https://logos.galtzo.com/assets/images/ruby-lang/avatar-192px.svg" alt="ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://logos.galtzo.com/assets/images/oauth/oauth2/avatar-192px.svg" alt="oauth2 Logo by Chris Messina, CC BY-SA 3.0"></a></p>
-
-<h1 id="-oauth-20-authorization-framework">🔐 OAuth 2.0 Authorization Framework</h1>
+      <div id="content"><div id='filecontents'><table>
+  <thead>
+    <tr>
+      <th>📍 NOTE</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>RubyGems (the <a href="https://github.com/rubygems/">GitHub org</a>, not the website) <a href="https://joel.drapper.me/p/ruby-central-security-measures/">suffered</a> a <a href="https://pup-e.com/blog/goodbye-rubygems/">hostile takeover</a> in September 2025.</td>
+    </tr>
+    <tr>
+      <td>Ultimately <a href="https://www.reddit.com/r/ruby/s/gOk42POCaV">4 maintainers</a> were <a href="https://bsky.app/profile/martinemde.com/post/3m3occezxxs2q">hard removed</a> and a reason has been given for only 1 of those, while 2 others resigned in protest.</td>
+    </tr>
+    <tr>
+      <td>It is a <a href="https://joel.drapper.me/p/ruby-central-takeover/">complicated story</a> which is difficult to <a href="https://joel.drapper.me/p/ruby-central-fact-check/">parse quickly</a>.</td>
+    </tr>
+    <tr>
+      <td>I’m adding notes like this to gems because I <a href="https://joel.drapper.me/p/ruby-central/">don’t condone theft</a> of repositories or gems from their rightful owners.</td>
+    </tr>
+    <tr>
+      <td>If a similar theft happened with my repos/gems, I’d hope some would stand up for me.</td>
+    </tr>
+    <tr>
+      <td>Disenfranchised former-maintainers have started <a href="https://gem.coop">gem.coop</a>.</td>
+    </tr>
+    <tr>
+      <td>Once available I will publish there exclusively; unless RubyCentral makes amends with the community.</td>
+    </tr>
+    <tr>
+      <td>The <a href="https://youtu.be/_H4qbtC5qzU?si=BvuBU90R2wAqD2E6">“Technology for Humans: Joel Draper”</a> podcast episode by <a href="https://reinteractive.com/ruby-on-rails">reinteractive</a> is the most cogent summary I’m aware of.</td>
+    </tr>
+    <tr>
+      <td>See <a href="https://github.com/gem-coop/gem.coop/issues/12">here</a>, <a href="https://gem.coop">here</a> and <a href="https://martinemde.com/2025/10/05/announcing-gem-coop.html">here</a> for more info on what comes next.</td>
+    </tr>
+    <tr>
+      <td>What I’m doing: A (WIP) proposal for <a href="https://github.com/galtzo-floss/bundle-namespace">bundler/gem scopes</a>, and a (WIP) proposal for a federated <a href="https://github.com/galtzo-floss/gem-server">gem server</a>.</td>
+    </tr>
+  </tbody>
+</table>
+
+<p><a href="https://discord.gg/3qme4XHNKN"><img src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg" alt="Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0"></a> <a href="https://www.ruby-lang.org/"><img src="https://logos.galtzo.com/assets/images/ruby-lang/avatar-192px.svg" alt="ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://logos.galtzo.com/assets/images/oauth/oauth2/avatar-192px.svg" alt="oauth2 Logo by Chris Messina, CC BY-SA 3.0"></a></p>
+
+<h1 id="oauth-20-authorization-framework">🔐 OAuth 2.0 Authorization Framework</h1>
 
 <p>⭐️ including OAuth 2.1 draft spec &amp; OpenID Connect (OIDC)</p>
 
-<p>[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![Open Source Helpers][👽oss-helpi]][👽oss-help] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]</p>
+<p><a href="https://bestgems.org/gems/oauth2"><img src="https://img.shields.io/gem/v/oauth2.svg" alt="Version"></a> <a href="http://github.com/ruby-oauth/oauth2/releases"><img src="https://img.shields.io/github/tag/ruby-oauth/oauth2.svg" alt="GitHub tag (latest SemVer)"></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-259D6C.svg" alt="License: MIT"></a> <a href="https://bestgems.org/gems/oauth2"><img src="https://img.shields.io/gem/rd/oauth2.svg" alt="Downloads Rank"></a> <a href="https://www.codetriage.com/ruby-oauth/oauth2"><img src="https://www.codetriage.com/ruby-oauth/oauth2/badges/users.svg" alt="Open Source Helpers"></a> <a href="https://codecov.io/gh/ruby-oauth/oauth2"><img src="https://codecov.io/gh/ruby-oauth/oauth2/graph/badge.svg" alt="CodeCov Test Coverage"></a> <a href="https://coveralls.io/github/ruby-oauth/oauth2?branch=main"><img src="https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main" alt="Coveralls Test Coverage"></a> <a href="https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating"><img src="https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg" alt="QLTY Test Coverage"></a> <a href="https://qlty.sh/gh/ruby-oauth/projects/oauth2"><img src="https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg" alt="QLTY Maintainability"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml/badge.svg" alt="CI Heads"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml/badge.svg" alt="CI Runtime Dependencies @ HEAD"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml/badge.svg" alt="CI Current"></a> [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml/badge.svg" alt="CI JRuby"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml/badge.svg" alt="Deps Locked"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml/badge.svg" alt="Deps Unlocked"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml/badge.svg" alt="CI Supported"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml/badge.svg" alt="CI Legacy"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml/badge.svg" alt="CI Unsupported"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml/badge.svg" alt="CI Ancient"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml/badge.svg" alt="CI Test Coverage"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml/badge.svg" alt="CI Style"></a> <a href="https://github.com/ruby-oauth/oauth2/security/code-scanning"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/codeql-analysis.yml/badge.svg" alt="CodeQL"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml/badge.svg" alt="Apache SkyWalking Eyes License Compatibility Check"></a></p>
 
 <p><code>if ci_badges.map(&amp;:color).detect { it != "green"}</code> ☝️ <a href="https://discord.gg/3qme4XHNKN">let me know</a>, as I may have missed the <a href="https://discord.gg/3qme4XHNKN">discord notification</a>.</p>
 
@@ -71,13 +111,13 @@ <h1 id="-oauth-20-authorization-framework">🔐 OAuth 2.0 Authorization Framewor
 
 <p><code>if ci_badges.map(&amp;:color).all? { it == "green"}</code> 👇️ send money so I can do more of this. FLOSS maintenance is now my full-time job.</p>
 
-<p>[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]</p>
+<p><a href="https://opencollective.com/ruby-oauth#backer"><img src="https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat" alt="OpenCollective Backers"></a> <a href="https://opencollective.com/ruby-oauth#sponsor"><img src="https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat" alt="OpenCollective Sponsors"></a> <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github" alt="Sponsor Me on Github"></a> <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat" alt="Liberapay Goal Progress"></a> <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal" alt="Donate on PayPal"></a> <a href="https://www.buymeacoffee.com/pboling"><img src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat" alt="Buy me a coffee"></a> <a href="https://polar.sh/pboling"><img src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat" alt="Donate on Polar"></a> <a href="https://ko-fi.com/O5O86SNP4"><img src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat" alt="Donate at ko-fi.com"></a></p>
 
-<h2 id="-synopsis">🌻 Synopsis</h2>
+<h2 id="synopsis">🌻 Synopsis</h2>
 
-<p>OAuth 2.0 is the industry-standard protocol for authorization.<br>
-OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,<br>
-    desktop applications, mobile phones, and living room devices.<br>
+<p>OAuth 2.0 is the industry-standard protocol for authorization.
+OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,
+    desktop applications, mobile phones, and living room devices.
 This is a RubyGem for implementing OAuth 2.0 clients (not servers) in Ruby applications.</p>
 
 <h3 id="quick-examples">Quick Examples</h3>
@@ -85,7 +125,7 @@ <h3 id="quick-examples">Quick Examples</h3>
 <details>
   <summary>Convert the following `curl` command into a token request using this gem...</summary>
 
-```shell
+  <p><code>shell
 curl --request POST \
   --url 'https://login.microsoftonline.com/REDMOND_REDACTED/oauth2/token' \
   --header 'content-type: application/x-www-form-urlencoded' \
@@ -93,11 +133,11 @@ <h3 id="quick-examples">Quick Examples</h3>
   --data client_id=REDMOND_CLIENT_ID \
   --data client_secret=REDMOND_CLIENT_SECRET \
   --data resource=REDMOND_RESOURCE_UUID
-```
+</code></p>
 
-NOTE: In the ruby version below, certain params are passed to the `get_token` call, instead of the client creation.
+  <p>NOTE: In the ruby version below, certain params are passed to the <code>get_token</code> call, instead of the client creation.</p>
 
-```ruby
+  <p><code>ruby
 OAuth2::Client.new(
   "REDMOND_CLIENT_ID", # client_id
   "REDMOND_CLIENT_SECRET", # client_secret
@@ -107,469 +147,485 @@ <h3 id="quick-examples">Quick Examples</h3>
 ). # The base path for token_url when it is relative
   client_credentials. # There are many other types to choose from!
   get_token(resource: "REDMOND_RESOURCE_UUID")
-```
+</code></p>
 
-NOTE: `header` - The content type specified in the `curl` is already the default!
+  <p>NOTE: <code>header</code> - The content type specified in the <code>curl</code> is already the default!</p>
 
 </details>
 
-<details>
+<p>&lt;details markdown=”1&gt;</p>
 <summary>Complete E2E single file script against mock-oauth2-server</summary>
 
-- E2E example uses [navikt/mock-oauth2-server](https://github.com/navikt/mock-oauth2-server), which was added in v2.0.11
-- E2E example does not ship with the released gem, so clone the source to play with it.
+<ul>
+  <li>E2E example uses <a href="https://github.com/navikt/mock-oauth2-server">navikt/mock-oauth2-server</a>, which was added in v2.0.11</li>
+  <li>E2E example does not ship with the released gem, so clone the source to play with it.</li>
+</ul>
 
-```console
+<p><code>console
 docker compose -f docker-compose-ssl.yml up -d --wait
 ruby examples/e2e.rb
 # If your machine is slow or Docker pulls are cold, increase the wait:
 E2E_WAIT_TIMEOUT=120 ruby examples/e2e.rb
 # The mock server serves HTTP on 8080; the example points to http://localhost:8080 by default.
-```
+</code></p>
 
-The output should be something like this:
+<p>The output should be something like this:</p>
 
-```console
+<p><code>console
 ➜  ruby examples/e2e.rb
 Access token (truncated): eyJraWQiOiJkZWZhdWx0...
 userinfo status: 200
-userinfo body: =&gt; "demo-sub", "aud" =&gt; ["demo-aud"], "nbf" =&gt; 1757816758000, "iss" =&gt; "http://localhost:8080/default", "exp" =&gt; 1757820358000, "iat" =&gt; 1757816758000, "jti" =&gt; "d63b97a7-ebe5-4dea-93e6-d542caba6104"
+userinfo body: {"sub" =&gt; "demo-sub", "aud" =&gt; ["demo-aud"], "nbf" =&gt; 1757816758000, "iss" =&gt; "http://localhost:8080/default", "exp" =&gt; 1757820358000, "iat" =&gt; 1757816758000, "jti" =&gt; "d63b97a7-ebe5-4dea-93e6-d542caba6104"}
 E2E complete
-```
+</code></p>
 
-Make sure to shut down the mock server when you are done:
+<p>Make sure to shut down the mock server when you are done:</p>
 
-```console
+<p><code>console
 docker compose -f docker-compose-ssl.yml down
-```
-
-Troubleshooting: validate connectivity to the mock server
-
-- Check container status and port mapping:
-    - `docker compose -f docker-compose-ssl.yml ps`
-- From the host, try the discovery URL directly (this is what the example uses by default):
-    - `curl -v http://localhost:8080/default/.well-known/openid-configuration`
-    - If that fails immediately, also try: `curl -v --connect-timeout 2 http://127.0.0.1:8080/default/.well-known/openid-configuration`
-- From inside the container (to distinguish container vs. host networking):
-    - `docker exec -it oauth2-mock-oauth2-server-1 curl -v http://127.0.0.1:8080/default/.well-known/openid-configuration`
-- Simple TCP probe from the host:
-    - `nc -vz localhost 8080  # or: ruby -rsocket -e 'TCPSocket.new("localhost",8080).close; puts "tcp ok"'`
-- Inspect which host port 8080 is bound to (should be 8080):
-    - `docker inspect -f '(index (index .NetworkSettings.Ports "8080/tcp") 0).HostPort }' oauth2-mock-oauth2-server-1`
-- Look at server logs for readiness/errors:
-    - `docker logs -n 200 oauth2-mock-oauth2-server-1`
-- On Linux, ensure nothing else is bound to 8080 and that firewall/SELinux aren’t blocking:
-    - `ss -ltnp | grep :8080`
-
-Notes
-- Discovery URL pattern is: `http://localhost:8080/<realm>/.well-known/openid-configuration`, where `<realm>` defaults to `default`.
-- You can change these with env vars when running the example:
-    - `E2E_ISSUER_BASE` (default: http://localhost:8080)
-    - `E2E_REALM` (default: default)
-
-&lt;/details&gt;
-
-If it seems like you are in the wrong place, you might try one of these:
-
-* [OAuth 2.0 Spec][oauth2-spec]
-* [doorkeeper gem][doorkeeper-gem] for OAuth 2.0 server/provider implementation.
-* [oauth sibling gem][sibling-gem] for OAuth 1.0a implementations in Ruby.
-
-[oauth2-spec]: https://oauth.net/2/
-[sibling-gem]: https://gitlab.com/ruby-oauth/oauth
-[doorkeeper-gem]: https://github.com/doorkeeper-gem/doorkeeper
-
-## 💡 Info you can shake a stick at
-
-| Tokens to Remember      | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace]                                                                                                                                                                                                                                                                                                                                                                               |
-|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Works with JRuby        | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]                                                                                                                                                                                                               |
-| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf]                                                                                                                                                                                                                                                                 |
-| Works with MRI Ruby 3   | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]                                                                                                                                                                                              |
-| Works with MRI Ruby 2   | ![Ruby 2.2 Compat][💎ruby-2.2i] <br> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf]                                                                                                                                                                                                   |
-| Support &amp; Community     | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]                                                                                                                                            |
-| Source                  | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc]                                                                                                                                                                                                                                                              |
-| Documentation           | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki]                                                                                                                                                                                               |
-| Compliance              | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Incident Response Plan][🔐irp-img]][🔐irp] [![Security Policy][🔐security-img]][🔐security] [![Threat Model][🔐threat-model-img]][🔐threat-model]  [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
-| Style                   | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2]                                                                                                                                                                                                                       |
-| Maintainer 🎖️          | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto]                                                                                                                                                           |
-| `...` 💖                | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub]  [🛖][💖🛖hut] [🧪][💖🧪lab]                                                                                                                                                                        |
-
-### Compatibility
-
-* Operating Systems: Linux, macOS, Windows
-* MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
-    * NOTE: This gem may still _install_ and _run_ on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* JRuby @ v9.4, v10.0, HEAD
-    * NOTE: This gem may still _install_ and _run_ on JRuby v9.2 and v9.3, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* TruffleRuby @ v23.1, v24.1, HEAD
-    * NOTE: This gem may still _install_ and _run_ on Truffleruby v22.3 and v23.0, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* gem `faraday` @ v0, v1, v2, HEAD ⏩️ [lostisland/faraday](https://github.com/lostisland/faraday)
-* gem `jwt` @ v1, v2, v3, HEAD ⏩️ [jwt/ruby-jwt](https://github.com/jwt/ruby-jwt)
-* gem `logger` @ v1.2, v1.5, v1.7, HEAD ⏩️ [ruby/logger](https://github.com/ruby/logger)
-* gem `multi_xml` @ v0.5, v0.6, v0.7, HEAD ⏩️ [sferik/multi_xml](https://github.com/sferik/multi_xml)
-* gem `rack` @ v1.2, v1.6, v2, v3, HEAD ⏩️ [rack/rack](https://github.com/rack/rack)
-* gem `snaky_hash` @ v2, HEAD ⏩️ [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash)
-* gem `version_gem` @ v1, HEAD ⏩️ [ruby-oauth/version_gem](https://gitlab.com/ruby-oauth/version_gem)
-
-The last two were extracted from this gem. They are part of the `ruby-oauth` org,
-and are developed in tight collaboration with this gem.
-
-Also, where reasonable, tested against the runtime dependencies of those dependencies:
-
-* gem `hashie` @ v0, v1, v2, v3, v4, v5, HEAD ⏩️ [hashie/hashie](https://github.com/hashie/hashie)
-
-[GHA-continue-on-error-ui]: https://github.com/actions/runner/issues/2347#issuecomment-2653479732
-[GHA-allow-failure]: https://github.com/orgs/community/discussions/15452
-
-#### Upgrading Runtime Gem Dependencies
-
-This project sits underneath a large portion of the authorization systems on the internet.
-According to GitHub's project tracking, which I believe only reports on public projects,
-[100,000+ projects](https://github.com/ruby-oauth/oauth2/network/dependents), and
-[500+ packages](https://github.com/ruby-oauth/oauth2/network/dependents?dependent_type=PACKAGE) depend on this project.
-
-That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
-
-As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the
-leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
-
-What does that mean specifically for the runtime dependencies?
-
-We have 100% test coverage of lines and branches, and this test suite runs across a very large matrix.
-It wouldn't be possible without appraisal2.
-
-| 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚             |
-|------------------------------------------------|--------------------------------------------------------|
-| 👟 Check it out!                               | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
-
-#### You should upgrade this gem with confidence\*.
-
-- This gem follows a _strict &amp; correct_ (according to the maintainer of SemVer; [more info][sv-pub-api]) interpretation of SemVer.
-    - Dropping support for **any** of the runtime dependency versions above will be a major version bump.
-    - If you aren't on one of the minor versions above, make getting there a priority.
-- You should upgrade the dependencies of this gem with confidence\*.
-- Please do upgrade, and then, when it goes smooth as butter [please sponsor me][🖇sponsor].  Thanks!
-
-[sv-pub-api]: #-versioning
-
-\* MIT license; The only guarantees I make are for [enterprise support](#enterprise-support).
+</code></p>
 
-<details>
-  <summary>Standard Library Dependencies</summary>
-
-The various versions of each are tested via the Ruby test matrix, along with whatever Ruby includes them.
-
-* base64
-* cgi
-* json
-* time
-* logger (removed from stdlib in Ruby 3.5 so added as runtime dependency in v2.0.10)
+<p>Troubleshooting: validate connectivity to the mock server</p>
 
-If you use a gem version of a core Ruby library, it should work fine!
-
-</details>
+<ul>
+  <li>Check container status and port mapping:
+    <ul>
+      <li><code>docker compose -f docker-compose-ssl.yml ps</code></li>
+    </ul>
+  </li>
+  <li>From the host, try the discovery URL directly (this is what the example uses by default):
+    <ul>
+      <li><code>curl -v http://localhost:8080/default/.well-known/openid-configuration</code></li>
+      <li>If that fails immediately, also try: <code>curl -v --connect-timeout 2 http://127.0.0.1:8080/default/.well-known/openid-configuration</code>
+</li>
+    </ul>
+  </li>
+  <li>From inside the container (to distinguish container vs. host networking):
+    <ul>
+      <li><code>docker exec -it oauth2-mock-oauth2-server-1 curl -v http://127.0.0.1:8080/default/.well-known/openid-configuration</code></li>
+    </ul>
+  </li>
+  <li>Simple TCP probe from the host:
+    <ul>
+      <li><code>nc -vz localhost 8080  # or: ruby -rsocket -e 'TCPSocket.new("localhost",8080).close; puts "tcp ok"'</code></li>
+    </ul>
+  </li>
+  <li>Inspect which host port 8080 is bound to (should be 8080):
+    <ul>
+      <li><code>docker inspect -f '{{ (index (index .NetworkSettings.Ports "8080/tcp") 0).HostPort }}' oauth2-mock-oauth2-server-1</code></li>
+    </ul>
+  </li>
+  <li>Look at server logs for readiness/errors:
+    <ul>
+      <li><code>docker logs -n 200 oauth2-mock-oauth2-server-1</code></li>
+    </ul>
+  </li>
+  <li>On Linux, ensure nothing else is bound to 8080 and that firewall/SELinux aren’t blocking:
+    <ul>
+      <li><code>ss -ltnp | grep :8080</code></li>
+    </ul>
+  </li>
+</ul>
 
-### Federated DVCS
+<p>Notes</p>
 
-<details>
-  <summary>Find this repo on federated forges</summary>
-
-| Federated [DVCS][💎d-in-dvcs] Repository      | Status                                                                | Issues                    | PRs                      | Wiki                      | CI                       | Discussions                  |
-|-----------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
-| 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl]    | The Truth                                                             | [💚][🤝gl-issues]         | [💚][🤝gl-pulls]         | [💚][📜gl-wiki]           | 🐭 Tiny Matrix           | ➖                            |
-| 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb]  | An Ethical Mirror ([Donate][🤝cb-donate])                             | [💚][🤝cb-issues]         | [💚][🤝cb-pulls]         | ➖                         | ⭕️ No Matrix             | ➖                            |
-| 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh]    | Another Mirror                                                        | [💚][🤝gh-issues]         | [💚][🤝gh-pulls]         | [💚][📜gh-wiki]           | 💯 Full Matrix           | [💚][gh-discussions]         |
-| 🤼 [OAuth Ruby Google Group][⛳gg-discussions] | "Active"                                                              | ➖                         | ➖                        | ➖                         | ➖                        | [💚][⛳gg-discussions]        |
-| 🎮️ [Discord Server][✉️discord-invite]        | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
+<ul>
+  <li>Discovery URL pattern is: <code>http://localhost:8080/&lt;realm&gt;/.well-known/openid-configuration</code>, where <code>&lt;realm&gt;</code> defaults to <code>default</code>.</li>
+  <li>You can change these with env vars when running the example:
+    <ul>
+      <li>
+<code>E2E_ISSUER_BASE</code> (default: http://localhost:8080)</li>
+      <li>
+<code>E2E_REALM</code> (default: default)</li>
+    </ul>
+  </li>
+</ul>
 
-</details>
+<p>&lt;/details&gt;</p>
 
-[gh-discussions]: https://github.com/ruby-oauth/oauth2/discussions
+<p>If it seems like you are in the wrong place, you might try one of these:</p>
 
-### Enterprise Support [![Tidelift](https://tidelift.com/badges/package/rubygems/oauth2)](https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme)
+<ul>
+  <li><a href="https://oauth.net/2/">OAuth 2.0 Spec</a></li>
+  <li>
+<a href="https://github.com/doorkeeper-gem/doorkeeper">doorkeeper gem</a> for OAuth 2.0 server/provider implementation.</li>
+  <li>
+<a href="https://gitlab.com/ruby-oauth/oauth">oauth sibling gem</a> for OAuth 1.0a implementations in Ruby.</li>
+</ul>
 
-Available as part of the Tidelift Subscription.
+<h2 id="info-you-can-shake-a-stick-at">💡 Info you can shake a stick at</h2>
+
+<table>
+  <thead>
+    <tr>
+      <th>Tokens to Remember</th>
+      <th>
+<a href="https://bestgems.org/gems/oauth2"><img src="https://img.shields.io/badge/name-oauth2-3C2D2D.svg?style=square&amp;logo=rubygems&amp;logoColor=red" alt="Gem name"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://img.shields.io/badge/namespace-OAuth2-3C2D2D.svg?style=square&amp;logo=ruby&amp;logoColor=white" alt="Gem namespace"></a>
+</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>Works with JRuby</td>
+      <td>
+<img src="https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.1 Compat"> <img src="https://img.shields.io/badge/JRuby-9.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.2 Compat"> <img src="https://img.shields.io/badge/JRuby-9.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.3 Compat"> <br> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml"><img src="https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.4 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://img.shields.io/badge/JRuby-current-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=green" alt="JRuby 10.0 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml"><img src="https://img.shields.io/badge/JRuby-HEAD-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue" alt="JRuby HEAD Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Works with Truffle Ruby</td>
+      <td>
+<img src="https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink" alt="Truffle Ruby 22.3 Compat"> <img src="https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink" alt="Truffle Ruby 23.0 Compat"> <img src="https://img.shields.io/badge/Truffle_Ruby-23.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink" alt="Truffle Ruby 23.1 Compat"> <br> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=green" alt="Truffle Ruby 24.1 Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Works with MRI Ruby 3</td>
+      <td>
+<a href="https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml"><img src="https://img.shields.io/badge/Ruby-3.0-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.0 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://img.shields.io/badge/Ruby-3.1-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.1 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://img.shields.io/badge/Ruby-3.2-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.2 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://img.shields.io/badge/Ruby-3.3-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.3 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=green" alt="Ruby 3.4 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml"><img src="https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue" alt="Ruby HEAD Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Works with MRI Ruby 2</td>
+      <td>
+<img src="https://img.shields.io/badge/Ruby-2.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.2 Compat"> <br> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://img.shields.io/badge/Ruby-2.3-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.3 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://img.shields.io/badge/Ruby-2.4-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.4 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://img.shields.io/badge/Ruby-2.5-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.5 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml"><img src="https://img.shields.io/badge/Ruby-2.6-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.6 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml"><img src="https://img.shields.io/badge/Ruby-2.7-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.7 Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Support &amp; Community</td>
+      <td>
+<a href="https://app.daily.dev/squads/rubyfriends"><img src="https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&amp;logo=dailydotdev&amp;logoColor=white" alt="Join Me on Daily.dev's RubyFriends"></a> <a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a> <a href="https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share"><img src="https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&amp;logo=Upwork&amp;logoColor=white" alt="Get help from me on Upwork"></a> <a href="https://www.codementor.io/peterboling?utm_source=github&amp;utm_medium=button&amp;utm_term=peterboling&amp;utm_campaign=github"><img src="https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&amp;logo=CodeMentor&amp;logoColor=white" alt="Get help from me on Codementor"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Source</td>
+      <td>
+<a href="https://gitlab.com/ruby-oauth/oauth2/"><img src="https://img.shields.io/badge/GitLab-FBA326?style=for-the-badge&amp;logo=Gitlab&amp;logoColor=orange" alt="Source on GitLab.com"></a> <a href="https://codeberg.org/ruby-oauth/oauth2"><img src="https://img.shields.io/badge/CodeBerg-4893CC?style=for-the-badge&amp;logo=CodeBerg&amp;logoColor=blue" alt="Source on CodeBerg.org"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://img.shields.io/badge/GitHub-238636?style=for-the-badge&amp;logo=Github&amp;logoColor=green" alt="Source on Github.com"></a> <a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ"><img src="https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&amp;logo=YouTube&amp;logoColor=blue" alt="The best SHA: dQw4w9WgXcQ!"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Documentation</td>
+      <td>
+<a href="http://rubydoc.info/gems/oauth2"><img src="https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white" alt="Current release on RubyDoc.info"></a> <a href="https://oauth2.galtzo.com"><img src="https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white" alt="YARD on Galtzo.com"></a> <a href="http://www.railsbling.com/tags/oauth2"><img src="https://img.shields.io/badge/blog-railsbling-0093D0.svg?style=for-the-badge&amp;logo=rubyonrails&amp;logoColor=orange" alt="Maintainer Blog"></a> <a href="https://gitlab.com/ruby-oauth/oauth2/-/wikis/home"><img src="https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=gitlab&amp;logoColor=white" alt="GitLab Wiki"></a> <a href="https://github.com/ruby-oauth/oauth2/wiki"><img src="https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=github&amp;logoColor=white" alt="GitHub Wiki"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Compliance</td>
+      <td>
+<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-259D6C.svg" alt="License: MIT"></a> <a href="https://dev.to/galtzo/how-to-check-license-compatibility-41h0"><img src="https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&amp;logo=Apache" alt="Compatible with Apache Software Projects: Verified by SkyWalking Eyes"></a> <a href="https://www.ilo.org/declaration/lang--en/index.htm"><img src="https://img.shields.io/badge/ILO_Fundamental_Principles-%E2%9C%93-259D6C.svg?style=flat" alt="📄ilo-declaration-img"></a> <a href="SECURITY.md"><img src="https://img.shields.io/badge/security-policy-259D6C.svg?style=flat" alt="Security Policy"></a> <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg" alt="Contributor Covenant 2.1"></a> <a href="https://semver.org/spec/v2.0.0.html"><img src="https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat" alt="SemVer 2.0.0"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Style</td>
+      <td>
+<a href="https://github.com/rubocop-lts/rubocop-lts"><img src="https://img.shields.io/badge/code_style_&amp;_linting-rubocop--lts-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white" alt="Enforced Code Style Linter"></a> <a href="https://keepachangelog.com/en/1.0.0/"><img src="https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat" alt="Keep-A-Changelog 1.0.0"></a> <a href="https://gitmoji.dev"><img src="https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square" alt="Gitmoji Commits"></a> <a href="https://github.com/appraisal-rb/appraisal2"><img src="https://img.shields.io/badge/appraised_by-appraisal2-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white" alt="Compatibility appraised by: appraisal2"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Maintainer 🎖️</td>
+      <td>
+<a href="http://www.linkedin.com/in/peterboling"><img src="https://img.shields.io/badge/PeterBoling-LinkedIn-0B66C2?style=flat&amp;logo=newjapanprowrestling" alt="Follow Me on LinkedIn"></a> <a href="https://ruby.social/@galtzo"><img src="https://img.shields.io/mastodon/follow/109447111526622197?domain=https://ruby.social&amp;style=flat&amp;logo=mastodon&amp;label=Ruby%20@galtzo" alt="Follow Me on Ruby.Social"></a> <a href="https://bsky.app/profile/galtzo.com"><img src="https://img.shields.io/badge/@galtzo.com-0285FF?style=flat&amp;logo=bluesky&amp;logoColor=white" alt="Follow Me on Bluesky"></a> <a href="http://www.railsbling.com/contact"><img src="https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&amp;logo=rubyonrails&amp;logoColor=red" alt="Contact Maintainer"></a> <a href="https://dev.to/galtzo"><img src="https://img.shields.io/badge/dev.to-0A0A0A?style=flat&amp;logo=devdotto&amp;logoColor=white" alt="My technical writing"></a>
+</td>
+    </tr>
+    <tr>
+      <td>
+<code>...</code> 💖</td>
+      <td>
+<a href="https://wellfound.com/u/peter-boling"><img src="https://img.shields.io/badge/peter--boling-orange?style=flat&amp;logo=wellfound" alt="Find Me on WellFound:"></a> <a href="https://www.crunchbase.com/person/peter-boling"><img src="https://img.shields.io/badge/peter--boling-purple?style=flat&amp;logo=crunchbase" alt="Find Me on CrunchBase"></a> <a href="https://linktr.ee/galtzo"><img src="https://img.shields.io/badge/galtzo-purple?style=flat&amp;logo=linktree" alt="My LinkTree"></a> <a href="https://about.me/peter.boling"><img src="https://img.shields.io/badge/about.me-0A0A0A?style=flat&amp;logo=aboutme&amp;logoColor=white" alt="More About Me"></a> <a href="https://codeberg.org/pboling">🧊</a> <a href="https://github.org/pboling">🐙</a>  <a href="https://sr.ht/~galtzo/">🛖</a> <a href="https://gitlab.com/pboling">🧪</a>
+</td>
+    </tr>
+  </tbody>
+</table>
+
+<h3 id="compatibility">Compatibility</h3>
+
+<p>Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.</p>
+
+<table>
+  <thead>
+    <tr>
+      <th>🚚 <em>Amazing</em> test matrix was brought to you by</th>
+      <th>🔎 appraisal2 🔎 and the color 💚 green 💚</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>👟 Check it out!</td>
+      <td>✨ <a href="https://github.com/appraisal-rb/appraisal2">github.com/appraisal-rb/appraisal2</a> ✨</td>
+    </tr>
+  </tbody>
+</table>
+
+<h3 id="federated-dvcs">Federated DVCS</h3>
 
 <details>
-  <summary>Need enterprise-level guarantees?</summary>
-
-The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
-
-[![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]
-
-- 💡Subscribe for support guarantees covering _all_ your FLOSS dependencies
-- 💡Tidelift is part of [Sonar][🏙️entsup-tidelift-sonar]
-- 💡Tidelift pays maintainers to maintain the software you depend on!<br>📊`@`Pointy Haired Boss: An [enterprise support][🏙️entsup-tidelift] subscription is "[never gonna let you down][🧮kloc]", and *supports* open source maintainers
-
-Alternatively:
-
-- [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
-- [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork]
-- [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]
+  <summary>Find this repo on federated forges (Coming soon!)</summary>
+
+  <table>
+    <thead>
+      <tr>
+        <th>Federated <a href="https://railsbling.com/posts/dvcs/put_the_d_in_dvcs/">DVCS</a> Repository</th>
+        <th>Status</th>
+        <th>Issues</th>
+        <th>PRs</th>
+        <th>Wiki</th>
+        <th>CI</th>
+        <th>Discussions</th>
+      </tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td>🧪 <a href="https://gitlab.com/ruby-oauth/oauth2/">ruby-oauth/oauth2 on GitLab</a>
+</td>
+        <td>The Truth</td>
+        <td><a href="https://gitlab.com/ruby-oauth/oauth2/-/issues">💚</a></td>
+        <td><a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests">💚</a></td>
+        <td><a href="https://gitlab.com/ruby-oauth/oauth2/-/wikis/home">💚</a></td>
+        <td>🐭 Tiny Matrix</td>
+        <td>➖</td>
+      </tr>
+      <tr>
+        <td>🧊 <a href="https://codeberg.org/ruby-oauth/oauth2">ruby-oauth/oauth2 on CodeBerg</a>
+</td>
+        <td>An Ethical Mirror (<a href="https://donate.codeberg.org/">Donate</a>)</td>
+        <td><a href="https://codeberg.org/ruby-oauth/oauth2/issues">💚</a></td>
+        <td><a href="https://codeberg.org/ruby-oauth/oauth2/pulls">💚</a></td>
+        <td>➖</td>
+        <td>⭕️ No Matrix</td>
+        <td>➖</td>
+      </tr>
+      <tr>
+        <td>🐙 <a href="https://github.com/ruby-oauth/oauth2">ruby-oauth/oauth2 on GitHub</a>
+</td>
+        <td>Another Mirror</td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/issues">💚</a></td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/pulls">💚</a></td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/wiki">💚</a></td>
+        <td>💯 Full Matrix</td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/discussions">💚</a></td>
+      </tr>
+      <tr>
+        <td>🎮️ <a href="https://discord.gg/3qme4XHNKN">Discord Server</a>
+</td>
+        <td><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">Let’s</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">talk</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">about</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">this</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">library!</a></td>
+      </tr>
+    </tbody>
+  </table>
 
 </details>
 
-## 🚀 Release Documentation
+<h3 id="enterprise-support-tidelifthttpstideliftcombadgespackagerubygemsoauth2httpstideliftcomsubscriptionpkgrubygems-oauth2utmsourcerubygems-oauth2utmmediumreferralutmcampaignreadme">Enterprise Support <a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme"><img src="https://tidelift.com/badges/package/rubygems/oauth2" alt="Tidelift"></a>
+</h3>
 
-### Version 2.0.x
+<p>Available as part of the Tidelift Subscription.</p>
 
 <details>
-  <summary>2.0.x CHANGELOG and README</summary>
-
-| Version | Release Date | CHANGELOG                             | README                          |
-|---------|--------------|---------------------------------------|---------------------------------|
-| 2.0.17  | 2025-09-15   | [v2.0.17 CHANGELOG][2.0.17-changelog] | [v2.0.17 README][2.0.17-readme] |
-| 2.0.16  | 2025-09-14   | [v2.0.16 CHANGELOG][2.0.16-changelog] | [v2.0.16 README][2.0.16-readme] |
-| 2.0.15  | 2025-09-08   | [v2.0.15 CHANGELOG][2.0.15-changelog] | [v2.0.15 README][2.0.15-readme] |
-| 2.0.14  | 2025-08-31   | [v2.0.14 CHANGELOG][2.0.14-changelog] | [v2.0.14 README][2.0.14-readme] |
-| 2.0.13  | 2025-08-30   | [v2.0.13 CHANGELOG][2.0.13-changelog] | [v2.0.13 README][2.0.13-readme] |
-| 2.0.12  | 2025-05-31   | [v2.0.12 CHANGELOG][2.0.12-changelog] | [v2.0.12 README][2.0.12-readme] |
-| 2.0.11  | 2025-05-23   | [v2.0.11 CHANGELOG][2.0.11-changelog] | [v2.0.11 README][2.0.11-readme] |
-| 2.0.10  | 2025-05-17   | [v2.0.10 CHANGELOG][2.0.10-changelog] | [v2.0.10 README][2.0.10-readme] |
-| 2.0.9   | 2022-09-16   | [v2.0.9 CHANGELOG][2.0.9-changelog]   | [v2.0.9 README][2.0.9-readme]   |
-| 2.0.8   | 2022-09-01   | [v2.0.8 CHANGELOG][2.0.8-changelog]   | [v2.0.8 README][2.0.8-readme]   |
-| 2.0.7   | 2022-08-22   | [v2.0.7 CHANGELOG][2.0.7-changelog]   | [v2.0.7 README][2.0.7-readme]   |
-| 2.0.6   | 2022-07-13   | [v2.0.6 CHANGELOG][2.0.6-changelog]   | [v2.0.6 README][2.0.6-readme]   |
-| 2.0.5   | 2022-07-07   | [v2.0.5 CHANGELOG][2.0.5-changelog]   | [v2.0.5 README][2.0.5-readme]   |
-| 2.0.4   | 2022-07-01   | [v2.0.4 CHANGELOG][2.0.4-changelog]   | [v2.0.4 README][2.0.4-readme]   |
-| 2.0.3   | 2022-06-28   | [v2.0.3 CHANGELOG][2.0.3-changelog]   | [v2.0.3 README][2.0.3-readme]   |
-| 2.0.2   | 2022-06-24   | [v2.0.2 CHANGELOG][2.0.2-changelog]   | [v2.0.2 README][2.0.2-readme]   |
-| 2.0.1   | 2022-06-22   | [v2.0.1 CHANGELOG][2.0.1-changelog]   | [v2.0.1 README][2.0.1-readme]   |
-| 2.0.0   | 2022-06-21   | [v2.0.0 CHANGELOG][2.0.0-changelog]   | [v2.0.0 README][2.0.0-readme]   |
-
-</details>
-
-[2.0.17-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2017---2025-09-15
-[2.0.16-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2016---2025-09-14
-[2.0.15-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2015---2025-09-08
-[2.0.14-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2014---2025-08-31
-[2.0.13-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2013---2025-08-30
-[2.0.12-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2012---2025-05-31
-[2.0.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2011---2025-05-23
-[2.0.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2010---2025-05-17
-[2.0.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#209---2022-09-16
-[2.0.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#208---2022-09-01
-[2.0.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#207---2022-08-22
-[2.0.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#206---2022-07-13
-[2.0.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#205---2022-07-07
-[2.0.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#204---2022-07-01
-[2.0.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#203---2022-06-28
-[2.0.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#202---2022-06-24
-[2.0.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#201---2022-06-22
-[2.0.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#200---2022-06-21
-
-[2.0.17-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.17/README.md
-[2.0.16-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.16/README.md
-[2.0.15-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.15/README.md
-[2.0.14-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.14/README.md
-[2.0.13-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.13/README.md
-[2.0.12-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.12/README.md
-[2.0.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.11/README.md
-[2.0.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.10/README.md
-[2.0.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.9/README.md
-[2.0.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.8/README.md
-[2.0.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.7/README.md
-[2.0.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.6/README.md
-[2.0.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.5/README.md
-[2.0.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.4/README.md
-[2.0.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.3/README.md
-[2.0.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.2/README.md
-[2.0.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.1/README.md
-[2.0.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.0/README.md
-
-### Older Releases
-
-<details>
-  <summary>1.4.x CHANGELOGs and READMEs</summary>
-
-| Version | Release Date | CHANGELOG                             | README                          |
-|---------|--------------|---------------------------------------|---------------------------------|
-| 1.4.11  | Sep 16, 2022 | [v1.4.11 CHANGELOG][1.4.11-changelog] | [v1.4.11 README][1.4.11-readme] |
-| 1.4.10  | Jul 1, 2022  | [v1.4.10 CHANGELOG][1.4.10-changelog] | [v1.4.10 README][1.4.10-readme] |
-| 1.4.9   | Feb 20, 2022 | [v1.4.9 CHANGELOG][1.4.9-changelog]   | [v1.4.9 README][1.4.9-readme]   |
-| 1.4.8   | Feb 18, 2022 | [v1.4.8 CHANGELOG][1.4.8-changelog]   | [v1.4.8 README][1.4.8-readme]   |
-| 1.4.7   | Mar 19, 2021 | [v1.4.7 CHANGELOG][1.4.7-changelog]   | [v1.4.7 README][1.4.7-readme]   |
-| 1.4.6   | Mar 19, 2021 | [v1.4.6 CHANGELOG][1.4.6-changelog]   | [v1.4.6 README][1.4.6-readme]   |
-| 1.4.5   | Mar 18, 2021 | [v1.4.5 CHANGELOG][1.4.5-changelog]   | [v1.4.5 README][1.4.5-readme]   |
-| 1.4.4   | Feb 12, 2020 | [v1.4.4 CHANGELOG][1.4.4-changelog]   | [v1.4.4 README][1.4.4-readme]   |
-| 1.4.3   | Jan 29, 2020 | [v1.4.3 CHANGELOG][1.4.3-changelog]   | [v1.4.3 README][1.4.3-readme]   |
-| 1.4.2   | Oct 1, 2019  | [v1.4.2 CHANGELOG][1.4.2-changelog]   | [v1.4.2 README][1.4.2-readme]   |
-| 1.4.1   | Oct 13, 2018 | [v1.4.1 CHANGELOG][1.4.1-changelog]   | [v1.4.1 README][1.4.1-readme]   |
-| 1.4.0   | Jun 9, 2017  | [v1.4.0 CHANGELOG][1.4.0-changelog]   | [v1.4.0 README][1.4.0-readme]   |
-</details>
+  <summary>Need enterprise-level guarantees?</summary>
 
-[1.4.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1411---2022-09-16
-[1.4.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1410---2022-07-01
-[1.4.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#149---2022-02-20
-[1.4.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#148---2022-02-18
-[1.4.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#147---2021-03-19
-[1.4.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#146---2021-03-19
-[1.4.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#145---2021-03-18
-[1.4.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#144---2020-02-12
-[1.4.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#143---2020-01-29
-[1.4.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#142---2019-10-01
-[1.4.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#141---2018-10-13
-[1.4.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#140---2017-06-09
-
-[1.4.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.11/README.md
-[1.4.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.10/README.md
-[1.4.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.9/README.md
-[1.4.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.8/README.md
-[1.4.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.7/README.md
-[1.4.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.6/README.md
-[1.4.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.5/README.md
-[1.4.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.4/README.md
-[1.4.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.3/README.md
-[1.4.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.2/README.md
-[1.4.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.1/README.md
-[1.4.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.0/README.md
+  <p>The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.</p>
 
-<details>
-  <summary>1.3.x Readmes</summary>
+  <p><a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme"><img src="https://img.shields.io/badge/Tidelift_and_Sonar-Enterprise_Support-FD3456?style=for-the-badge&amp;logo=sonar&amp;logoColor=white" alt="Get help from me on Tidelift"></a></p>
 
-| Version | Release Date | Readme                                                       |
-|---------|--------------|--------------------------------------------------------------|
-| 1.3.1   | Mar 3, 2017  | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.1/README.md |
-| 1.3.0   | Dec 27, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.0/README.md |
+  <ul>
+    <li>💡Subscribe for support guarantees covering <em>all</em> your FLOSS dependencies</li>
+    <li>💡Tidelift is part of <a href="https://blog.tidelift.com/tidelift-joins-sonar">Sonar</a>
+</li>
+    <li>💡Tidelift pays maintainers to maintain the software you depend on!<br>📊<code>@</code>Pointy Haired Boss: An <a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme">enterprise support</a> subscription is “<a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ">never gonna let you down</a>”, and <em>supports</em> open source maintainers</li>
+  </ul>
 
-</details>
+  <p>Alternatively:</p>
 
-<details>
-  <summary>≤= 1.2.x Readmes (2016 and before)</summary>
-
-| Version | Release Date | Readme                                                       |
-|---------|--------------|--------------------------------------------------------------|
-| 1.2.0   | Jun 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.2.0/README.md |
-| 1.1.0   | Jan 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.1.0/README.md |
-| 1.0.0   | May 23, 2014 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.0.0/README.md |
-| &lt; 1.0.0 | Find here    | https://gitlab.com/ruby-oauth/oauth2/-/tags                  |
+  <ul>
+    <li><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a></li>
+    <li><a href="https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share"><img src="https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&amp;logo=Upwork&amp;logoColor=white" alt="Get help from me on Upwork"></a></li>
+    <li><a href="https://www.codementor.io/peterboling?utm_source=github&amp;utm_medium=button&amp;utm_term=peterboling&amp;utm_campaign=github"><img src="https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&amp;logo=CodeMentor&amp;logoColor=white" alt="Get help from me on Codementor"></a></li>
+  </ul>
 
 </details>
 
-## ✨ Installation
+<h2 id="installation">✨ Installation</h2>
 
-Install the gem and add to the application's Gemfile by executing:
+<p>Install the gem and add to the application’s Gemfile by executing:</p>
 
-```console
+<p><code>console
 bundle add oauth2
-```
+</code></p>
 
-If bundler is not being used to manage dependencies, install the gem by executing:
+<p>If bundler is not being used to manage dependencies, install the gem by executing:</p>
 
-```console
+<p><code>console
 gem install oauth2
-```
+</code></p>
 
-### 🔒 Secure Installation
+<h3 id="secure-installation">🔒 Secure Installation</h3>
 
 <details>
   <summary>For Medium or High Security Installations</summary>
 
-This gem is cryptographically signed and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
-[stone_checksums][💎stone_checksums]. Be sure the gem you install hasn’t been tampered with
-by following the instructions below.
+  <p>This gem is cryptographically signed, and has verifiable <a href="https://gitlab.com/ruby-oauth/oauth2/-/tree/main/checksums">SHA-256 and SHA-512</a> checksums by
+<a href="https://github.com/galtzo-floss/stone_checksums">stone_checksums</a>. Be sure the gem you install hasn’t been tampered with
+by following the instructions below.</p>
 
-Add my public key (if you haven’t already; will expire 2045-04-29) as a trusted certificate:
+  <p>Add my public key (if you haven’t already, expires 2045-04-29) as a trusted certificate:</p>
 
-```console
+  <p><code>console
 gem cert --add &lt;(curl -Ls https://raw.github.com/galtzo-floss/certs/main/pboling.pem)
-```
+</code></p>
 
-You only need to do that once.  Then proceed to install with:
+  <p>You only need to do that once.  Then proceed to install with:</p>
 
-```console
+  <p><code>console
 gem install oauth2 -P MediumSecurity
-```
+</code></p>
 
-The `MediumSecurity` trust profile will verify signed gems, but allow the installation of unsigned dependencies.
+  <p>The <code>MediumSecurity</code> trust profile will verify signed gems, but allow the installation of unsigned dependencies.</p>
 
-This is necessary because not all of `oauth2`’s dependencies are signed, so we cannot use `HighSecurity`.
+  <p>This is necessary because not all of <code>oauth2</code>’s dependencies are signed, so we cannot use <code>HighSecurity</code>.</p>
 
-If you want to up your security game full-time:
+  <p>If you want to up your security game full-time:</p>
 
-```console
+  <p><code>console
 bundle config set --global trust-policy MediumSecurity
-```
+</code></p>
 
-NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.
+  <p><code>MediumSecurity</code> instead of <code>HighSecurity</code> is necessary if not all the gems you use are signed.</p>
+
+  <p>NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.</p>
 
 </details>
 
-## What is new for v2.0?
-
-- Works with Ruby versions &gt;= 2.2
-- Drop support for the expired MAC Draft (all versions)
-- Support IETF rfc7515 JSON Web Signature - JWS (since v2.0.12)
-    - Support JWT `kid` for key discovery and management
-- Support IETF rfc7523 JWT Bearer Tokens (since v2.0.0)
-- Support IETF rfc7231 Relative Location in Redirect (since v2.0.0)
-- Support IETF rfc6749 Don't set oauth params when nil (since v2.0.0)
-- Support IETF rfc7009 Token Revocation (since v2.0.10, updated in v2.0.13 to support revocation via URL-encoded parameters)
-- Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523)
-- Support new formats, including from [jsonapi.org](http://jsonapi.org/format/): `application/vdn.api+json`, `application/vnd.collection+json`, `application/hal+json`, `application/problem+json`
-- Adds option to `OAuth2::Client#get_token`:
-    - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token`
-- Adds option to `OAuth2::AccessToken#initialize`:
-    - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency
-- By default, keys are transformed to snake case.
-    - Original keys will still work as previously, in most scenarios, thanks to [snaky_hash][snaky_hash] gem.
-    - However, this is a _breaking_ change if you rely on `response.parsed.to_h` to retain the original case, and the original wasn't snake case, as the keys in the result will be snake case.
-    - As of version 2.0.4 you can turn key transformation off with the `snaky: false` option.
-- By default, the `:auth_scheme` is now `:basic_auth` (instead of `:request_body`)
-    - Third-party strategies and gems may need to be updated if a provider was requiring client id/secret in the request body
-- [... A lot more](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md#200-2022-06-21-tag)
-
-[snaky_hash]: https://gitlab.com/ruby-oauth/snaky_hash
-
-## Compatibility
-
-Targeted ruby compatibility is non-EOL versions of Ruby, currently 3.2, 3.3, and 3.4.
-Compatibility is further distinguished as "Best Effort Support" or "Incidental Support" for older versions of Ruby.
+<h2 id="what-is-new-for-v20">What is new for v2.0?</h2>
+
+<ul>
+  <li>Works with Ruby versions &gt;= 2.2</li>
+  <li>Drop support for the expired MAC Draft (all versions)</li>
+  <li>Support IETF rfc7515 JSON Web Signature - JWS (since v2.0.12)
+    <ul>
+      <li>Support JWT <code>kid</code> for key discovery and management</li>
+    </ul>
+  </li>
+  <li>Support IETF rfc7523 JWT Bearer Tokens (since v2.0.0)</li>
+  <li>Support IETF rfc7231 Relative Location in Redirect (since v2.0.0)</li>
+  <li>Support IETF rfc6749 Don’t set oauth params when nil (since v2.0.0)</li>
+  <li>Support IETF rfc7009 Token Revocation (since v2.0.10, updated in v2.0.13 to support revocation via URL-encoded parameters)</li>
+  <li>Support <a href="https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC 1.0 Private Key JWT</a>; based on the OAuth JWT assertion specification <a href="https://tools.ietf.org/html/rfc7523">(RFC 7523)</a>
+</li>
+  <li>Support new formats, including from <a href="http://jsonapi.org/format/">jsonapi.org</a>: <code>application/vdn.api+json</code>, <code>application/vnd.collection+json</code>, <code>application/hal+json</code>, <code>application/problem+json</code>
+</li>
+  <li>Adds option to <code>OAuth2::Client#get_token</code>:
+    <ul>
+      <li>
+<code>:access_token_class</code> (<code>AccessToken</code>); user specified class to use for all calls to <code>get_token</code>
+</li>
+    </ul>
+  </li>
+  <li>Adds option to <code>OAuth2::AccessToken#initialize</code>:
+    <ul>
+      <li>
+<code>:expires_latency</code> (<code>nil</code>); number of seconds by which AccessToken validity will be reduced to offset latency</li>
+    </ul>
+  </li>
+  <li>By default, keys are transformed to snake case.
+    <ul>
+      <li>Original keys will still work as previously, in most scenarios, thanks to <a href="https://gitlab.com/ruby-oauth/snaky_hash">snaky_hash</a> gem.</li>
+      <li>However, this is a <em>breaking</em> change if you rely on <code>response.parsed.to_h</code> to retain the original case, and the original wasn’t snake case, as the keys in the result will be snake case.</li>
+      <li>As of version 2.0.4 you can turn key transformation off with the <code>snaky: false</code> option.</li>
+    </ul>
+  </li>
+  <li>By default, the <code>:auth_scheme</code> is now <code>:basic_auth</code> (instead of <code>:request_body</code>)
+    <ul>
+      <li>Third-party strategies and gems may need to be updated if a provider was requiring client id/secret in the request body</li>
+    </ul>
+  </li>
+  <li><a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md#200-2022-06-21-tag">… A lot more</a></li>
+</ul>
+
+<h2 id="compatibility-1">Compatibility</h2>
+
+<p>Targeted ruby compatibility is non-EOL versions of Ruby, currently 3.2, 3.3, and 3.4.
+Compatibility is further distinguished as “Best Effort Support” or “Incidental Support” for older versions of Ruby.
 This gem will install on Ruby versions &gt;= v2.2 for 2.x releases.
-See `1-4-stable` branch for older rubies.
+See <code>1-4-stable</code> branch for older rubies.</p>
 
-<details>
-  <summary>Ruby Engine Compatibility Policy</summary>
+<p>&lt;details markdown=”1&gt;</p>
+<summary>Ruby Engine Compatibility Policy</summary>
 
-This gem is tested against MRI, JRuby, and Truffleruby.
+<p>This gem is tested against MRI, JRuby, and Truffleruby.
 Each of those has varying versions that target a specific version of MRI Ruby.
 This gem should work in the just-listed Ruby engines according to the targeted MRI compatibility in the table below.
 If you would like to add support for additional engines,
-see [gemfiles/README.md](gemfiles/README.md), then submit a PR to the correct maintenance branch as according to the table below.
-</details>
+see <a href="gemfiles/README.md">gemfiles/README.md</a>, then submit a PR to the correct maintenance branch as according to the table below.</p>
 
-<details>
-  <summary>Ruby Version Compatibility Policy</summary>
+<p>&lt;/details&gt;</p>
+
+<p>&lt;details markdown=”1&gt;</p>
+<summary>Ruby Version Compatibility Policy</summary>
 
-If something doesn't work on one of these interpreters, it's a bug.
+<p>If something doesn’t work on one of these interpreters, it’s a bug.</p>
 
-This library may inadvertently work (or seem to work) on other Ruby
+<p>This library may inadvertently work (or seem to work) on other Ruby
 implementations; however, support will only be provided for the versions listed
-above.
+above.</p>
 
-If you would like this library to support another Ruby version, you may
+<p>If you would like this library to support another Ruby version, you may
 volunteer to be a maintainer. Being a maintainer entails making sure all tests
 run and pass on that implementation. When something breaks on your
 implementation, you will be responsible for providing patches in a timely
 fashion. If critical issues for a particular implementation exist at the time
-of a major release, support for that Ruby version may be dropped.
-</details>
-
-|     | Ruby OAuth2 Version | Maintenance Branch | Targeted Support     | Best Effort Support     | Incidental Support           |
-|:----|---------------------|--------------------|----------------------|-------------------------|------------------------------|
-| 1️⃣ | 2.0.x               | `main`             | 3.2, 3.3, 3.4        | 2.5, 2.6, 2.7, 3.0, 3.1 | 2.2, 2.3, 2.4                |
-| 2️⃣ | 1.4.x               | `1-4-stable`       | 3.2, 3.3, 3.4        | 2.5, 2.6, 2.7, 3.0, 3.1 | 1.9, 2.0, 2.1, 2.2, 2.3, 2.4 |
-| 3️⃣ | older               | N/A                | Best of luck to you! | Please upgrade!         |                              |
-
-NOTE: The 1.4 series will only receive critical security updates.
-See [SECURITY.md][🔐security] and [IRP.md][🔐irp].
-
-## ⚙️ Configuration
-
-You can turn on additional warnings.
-
-```ruby
+of a major release, support for that Ruby version may be dropped.</p>
+
+<p>&lt;/details&gt;</p>
+
+<table>
+  <thead>
+    <tr>
+      <th style="text-align: left"> </th>
+      <th>Ruby OAuth2 Version</th>
+      <th>Maintenance Branch</th>
+      <th>Targeted Support</th>
+      <th>Best Effort Support</th>
+      <th>Incidental Support</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td style="text-align: left">1️⃣</td>
+      <td>2.0.x</td>
+      <td><code>main</code></td>
+      <td>3.2, 3.3, 3.4</td>
+      <td>2.5, 2.6, 2.7, 3.0, 3.1</td>
+      <td>2.2, 2.3, 2.4</td>
+    </tr>
+    <tr>
+      <td style="text-align: left">2️⃣</td>
+      <td>1.4.x</td>
+      <td><code>1-4-stable</code></td>
+      <td>3.2, 3.3, 3.4</td>
+      <td>2.5, 2.6, 2.7, 3.0, 3.1</td>
+      <td>1.9, 2.0, 2.1, 2.2, 2.3, 2.4</td>
+    </tr>
+    <tr>
+      <td style="text-align: left">3️⃣</td>
+      <td>older</td>
+      <td>N/A</td>
+      <td>Best of luck to you!</td>
+      <td>Please upgrade!</td>
+      <td> </td>
+    </tr>
+  </tbody>
+</table>
+
+<p>NOTE: The 1.4 series will only receive critical security updates.
+See <a href="SECURITY.md">SECURITY.md</a> and <a href="IRP.md">IRP.md</a>.</p>
+
+<h2 id="configuration">⚙️ Configuration</h2>
+
+<p>You can turn on additional warnings.</p>
+
+<p><code>ruby
 OAuth2.configure do |config|
   # Turn on a warning like:
   #   OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key
@@ -577,54 +633,56 @@ <h3 id="quick-examples">Quick Examples</h3>
   # Set to true if you want to also show warnings about no tokens
   config.silence_no_tokens_warning = false # default: true,
 end
-```
+</code></p>
 
-The "extra tokens" problem comes from ambiguity in the spec about which token is the right token.
+<p>The “extra tokens” problem comes from ambiguity in the spec about which token is the right token.
 Some OAuth 2.0 standards legitimately have multiple tokens.
-You may need to subclass `OAuth2::AccessToken`, or write your own custom alternative to it, and pass it in.
-Specify your custom class with the `access_token_class` option.
+You may need to subclass <code>OAuth2::AccessToken</code>, or write your own custom alternative to it, and pass it in.
+Specify your custom class with the <code>access_token_class</code> option.</p>
 
-If you only need one token, you can, as of v2.0.10,
-specify the exact token name you want to extract via the `OAuth2::AccessToken` using
-the `token_name` option.
+<p>If you only need one token, you can, as of v2.0.10,
+specify the exact token name you want to extract via the <code>OAuth2::AccessToken</code> using
+the <code>token_name</code> option.</p>
 
-You'll likely need to do some source diving.
+<p>You’ll likely need to do some source diving.
 This gem has 100% test coverage for lines and branches, so the specs are a great place to look for ideas.
-If you have time and energy, please contribute to the documentation!
+If you have time and energy, please contribute to the documentation!</p>
 
-## 🔧 Basic Usage
+<h2 id="basic-usage">🔧 Basic Usage</h2>
 
-### `authorize_url` and `token_url` are on site root (Just Works!)
+<h3 id="authorizeurl-and-tokenurl-are-on-site-root-just-works">
+<code>authorize_url</code> and <code>token_url</code> are on site root (Just Works!)</h3>
 
-```ruby
-require "oauth2"
-client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org")
-# =&gt; #&lt;OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
-client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth2/callback")
-# =&gt; "https://example.org/oauth/authorize?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code"
+<p>```ruby
+require “oauth2”
+client = OAuth2::Client.new(“client_id”, “client_secret”, site: “https://example.org”)
+# =&gt; #&lt;OAuth2::Client:0x00000001204c8288 @id=”client_id”, @secret=”client_sec…
+client.auth_code.authorize_url(redirect_uri: “http://localhost:8080/oauth2/callback”)
+# =&gt; “https://example.org/oauth/authorize?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code”</p>
 
-access = client.auth_code.get_token("authorization_code_value", redirect_uri: "http://localhost:8080/oauth2/callback", headers: =&gt; "Basic some_password")
-response = access.get("/api/resource", params: =&gt; "bar")
+<p>access = client.auth_code.get_token(“authorization_code_value”, redirect_uri: “http://localhost:8080/oauth2/callback”, headers: {”Authorization” =&gt; “Basic some_password”})
+response = access.get(“/api/resource”, params: {”query_foo” =&gt; “bar”})
 response.class.name
 # =&gt; OAuth2::Response
-```
+```</p>
 
-### Relative `authorize_url` and `token_url` (Not on site root, Just Works!)
+<h3 id="relative-authorizeurl-and-tokenurl-not-on-site-root-just-works">Relative <code>authorize_url</code> and <code>token_url</code> (Not on site root, Just Works!)</h3>
 
-In the above example, the default Authorization URL is `oauth/authorize` and default Access Token URL is `oauth/token`, and, as they are missing a leading `/`, both are relative.
+<p>In the above example, the default Authorization URL is <code>oauth/authorize</code> and default Access Token URL is <code>oauth/token</code>, and, as they are missing a leading <code>/</code>, both are relative.</p>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org/nested/directory/on/your/server")
 # =&gt; #&lt;OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
 client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth2/callback")
 # =&gt; "https://example.org/nested/directory/on/your/server/oauth/authorize?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code"
-```
+</code></p>
 
-### Customize `authorize_url` and `token_url`
+<h3 id="customize-authorizeurl-and-tokenurl">Customize <code>authorize_url</code> and <code>token_url</code>
+</h3>
 
-You can specify custom URLs for authorization and access token, and when using a leading `/` they will _not be relative_, as shown below:
+<p>You can specify custom URLs for authorization and access token, and when using a leading <code>/</code> they will <em>not be relative</em>, as shown below:</p>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(
   "client_id",
   "client_secret",
@@ -637,105 +695,109 @@ <h3 id="quick-examples">Quick Examples</h3>
 # =&gt; "https://example.org/jaunty/authorize/?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code"
 client.class.name
 # =&gt; OAuth2::Client
-```
+</code></p>
 
-### snake_case and indifferent access in Response#parsed
+<h3 id="snakecase-and-indifferent-access-in-responseparsed">snake_case and indifferent access in Response#parsed</h3>
 
-```ruby
-response = access.get("/api/resource", params: =&gt; "bar")
+<p><code>ruby
+response = access.get("/api/resource", params: {"query_foo" =&gt; "bar"})
 # Even if the actual response is CamelCase. it will be made available as snaky:
-JSON.parse(response.body)         # =&gt; "additionalData"=&gt;"additional"
-response.parsed                   # =&gt; "additional_data"=&gt;"additional"
+JSON.parse(response.body)         # =&gt; {"accessToken"=&gt;"aaaaaaaa", "additionalData"=&gt;"additional"}
+response.parsed                   # =&gt; {"access_token"=&gt;"aaaaaaaa", "additional_data"=&gt;"additional"}
 response.parsed.access_token      # =&gt; "aaaaaaaa"
 response.parsed[:access_token]    # =&gt; "aaaaaaaa"
 response.parsed.additional_data   # =&gt; "additional"
 response.parsed[:additional_data] # =&gt; "additional"
 response.parsed.class.name        # =&gt; SnakyHash::StringKeyed (from snaky_hash gem)
-```
+</code></p>
 
-#### Serialization
+<h4 id="serialization">Serialization</h4>
 
-As of v2.0.11, if you need to serialize the parsed result, you can!
+<p>As of v2.0.11, if you need to serialize the parsed result, you can!</p>
 
-There are two ways to do this, globally, or discretely.  The discrete way is recommended.
+<p>There are two ways to do this, globally, or discretely.  The discrete way is recommended.</p>
 
-##### Global Serialization Config
+<h5 id="global-serialization-config">Global Serialization Config</h5>
 
-Globally configure `SnakyHash::StringKeyed` to use the serializer. Put this in your code somewhere reasonable (like an initializer for Rails).
+<p>Globally configure <code>SnakyHash::StringKeyed</code> to use the serializer. Put this in your code somewhere reasonable (like an initializer for Rails).</p>
 
-```ruby
+<p><code>ruby
 SnakyHash::StringKeyed.class_eval do
   extend SnakyHash::Serializer
 end
-```
+</code></p>
 
-##### Discrete Serialization Config
+<h5 id="discrete-serialization-config">Discrete Serialization Config</h5>
 
-Discretely configure a custom Snaky Hash class to use the serializer.
+<p>Discretely configure a custom Snaky Hash class to use the serializer.</p>
 
-```ruby
+<p>```ruby
 class MySnakyHash &lt; SnakyHash::StringKeyed
-  # Give this hash class `dump` and `load` abilities!
+  # Give this hash class <code>dump</code> and <code>load</code> abilities!
   extend SnakyHash::Serializer
-end
+end</p>
 
-# And tell your client to use the custom class in each call:
-client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org/oauth2")
-token = client.get_token(MySnakyHash)
-```
+<h1 id="and-tell-your-client-to-use-the-custom-class-in-each-call">And tell your client to use the custom class in each call:</h1>
+<p>client = OAuth2::Client.new(“client_id”, “client_secret”, site: “https://example.org/oauth2”)
+token = client.get_token({snaky_hash_klass: MySnakyHash})
+```</p>
 
-##### Serialization Extensions
+<h5 id="serialization-extensions">Serialization Extensions</h5>
 
-These extensions work regardless of whether you used the global or discrete config above.
+<p>These extensions work regardless of whether you used the global or discrete config above.</p>
 
-There are a few hacks you may need in your class to support Ruby &lt; 2.4.2 or &lt; 2.6.
+<p>There are a few hacks you may need in your class to support Ruby &lt; 2.4.2 or &lt; 2.6.
 They are likely not needed if you are on a newer Ruby.
-See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb) if you need to study the hacks for older Rubies.
+Expand the examples below, or the <a href="https://gitlab.com/ruby-oauth/snaky_hash">ruby-oauth/snaky_hash</a> gem,
+or <a href="https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb">response_spec.rb</a>, for more ideas, especially if you need to study the hacks for older Rubies.</p>
+
+<p>&lt;details markdown=”1&gt;</p>
+<summary>See Examples</summary>
 
-```ruby
+<p>```ruby
 class MySnakyHash &lt; SnakyHash::StringKeyed
-  # Give this hash class `dump` and `load` abilities!
-  extend SnakyHash::Serializer
+  # Give this hash class <code>dump</code> and <code>load</code> abilities!
+  extend SnakyHash::Serializer</p>
 
-  #### Serialization Extentions
+<p>#### Serialization Extentions
   #
   # Act on the non-hash values (including the values of hashes) as they are dumped to JSON
   # In other words, this retains nested hashes, and only the deepest leaf nodes become bananas.
   # WARNING: This is a silly example!
   dump_value_extensions.add(:to_fruit) do |value|
-    "banana" # =&gt; Make values "banana" on dump
-  end
+    “banana” # =&gt; Make values “banana” on dump
+  end</p>
 
-  # Act on the non-hash values (including the values of hashes) as they are loaded from the JSON dump
-  # In other words, this retains nested hashes, and only the deepest leaf nodes become ***.
+<p># Act on the non-hash values (including the values of hashes) as they are loaded from the JSON dump
+  # In other words, this retains nested hashes, and only the deepest leaf nodes become <strong><em>.
   # WARNING: This is a silly example!
   load_value_extensions.add(:to_stars) do |value|
-    "***" # Turn dumped bananas into *** when they are loaded
-  end
+    “</em></strong>” # Turn dumped bananas into *** when they are loaded
+  end</p>
 
-  # Act on the entire hash as it is prepared for dumping to JSON
+<p># Act on the entire hash as it is prepared for dumping to JSON
   # WARNING: This is a silly example!
   dump_hash_extensions.add(:to_cheese) do |value|
     if value.is_a?(Hash)
       value.transform_keys do |key|
-        split = key.split("_")
+        split = key.split(“_”)
         first_word = split[0]
-        key.sub(first_word, "cheese")
+        key.sub(first_word, “cheese”)
       end
     else
       value
     end
-  end
+  end</p>
 
-  # Act on the entire hash as it is loaded from the JSON dump
+<p># Act on the entire hash as it is loaded from the JSON dump
   # WARNING: This is a silly example!
   load_hash_extensions.add(:to_pizza) do |value|
     if value.is_a?(Hash)
       res = klass.new
       value.keys.each_with_object(res) do |key, result|
-        split = key.split("_")
+        split = key.split(“_”)
         last_word = split[-1]
-        new_key = key.sub(last_word, "pizza")
+        new_key = key.sub(last_word, “pizza”)
         result[new_key] = value[key]
       end
       res
@@ -744,35 +806,35 @@ <h3 id="quick-examples">Quick Examples</h3>
     end
   end
 end
-```
+```</p>
 
-See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem for more ideas.
+<p>&lt;/details&gt;</p>
 
-#### Prefer camelCase over snake_case? =&gt; snaky: false
+<h4 id="prefer-camelcase-over-snakecase--snaky-false">Prefer camelCase over snake_case? =&gt; snaky: false</h4>
 
-```ruby
-response = access.get("/api/resource", params: =&gt; "bar", snaky: false)
-JSON.parse(response.body)         # =&gt; "additionalData"=&gt;"additional"
-response.parsed                   # =&gt; "additionalData"=&gt;"additional"
+<p><code>ruby
+response = access.get("/api/resource", params: {"query_foo" =&gt; "bar"}, snaky: false)
+JSON.parse(response.body)         # =&gt; {"accessToken"=&gt;"aaaaaaaa", "additionalData"=&gt;"additional"}
+response.parsed                   # =&gt; {"accessToken"=&gt;"aaaaaaaa", "additionalData"=&gt;"additional"}
 response.parsed["accessToken"]    # =&gt; "aaaaaaaa"
 response.parsed["additionalData"] # =&gt; "additional"
 response.parsed.class.name        # =&gt; Hash (just, regular old Hash)
-```
+</code></p>
 
 <details>
   <summary>Debugging &amp; Logging</summary>
 
-Set an environment variable as per usual (e.g. with [dotenv](https://github.com/bkeepers/dotenv)).
+  <p>Set an environment variable as per usual (e.g. with <a href="https://github.com/bkeepers/dotenv">dotenv</a>).</p>
 
-```ruby
+  <p><code>ruby
 # will log both request and response, including bodies
 ENV["OAUTH_DEBUG"] = "true"
-```
+</code></p>
 
-By default, debug output will go to `$stdout`. This can be overridden when
-initializing your OAuth2::Client.
+  <p>By default, debug output will go to <code>$stdout</code>. This can be overridden when
+initializing your OAuth2::Client.</p>
 
-```ruby
+  <p><code>ruby
 require "oauth2"
 client = OAuth2::Client.new(
   "client_id",
@@ -780,304 +842,377 @@ <h3 id="quick-examples">Quick Examples</h3>
   site: "https://example.org",
   logger: Logger.new("example.log", "weekly"),
 )
-```
+</code></p>
+
 </details>
 
-### OAuth2::Response
+<h3 id="oauth2response">OAuth2::Response</h3>
 
-The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic `#request`
-will return an instance of the #OAuth2::Response class.
+<p>The <code>AccessToken</code> methods <code>#get</code>, <code>#post</code>, <code>#put</code> and <code>#delete</code> and the generic <code>#request</code>
+will return an instance of the #OAuth2::Response class.</p>
 
-This instance contains a `#parsed` method that will parse the response body and
-return a Hash-like [`SnakyHash::StringKeyed`](https://gitlab.com/ruby-oauth/snaky_hash/-/blob/main/lib/snaky_hash/string_keyed.rb) if the `Content-Type` is `application/x-www-form-urlencoded` or if
+<p>This instance contains a <code>#parsed</code> method that will parse the response body and
+return a Hash-like <a href="https://gitlab.com/ruby-oauth/snaky_hash/-/blob/main/lib/snaky_hash/string_keyed.rb"><code>SnakyHash::StringKeyed</code></a> if the <code>Content-Type</code> is <code>application/x-www-form-urlencoded</code> or if
 the body is a JSON object.  It will return an Array if the body is a JSON
-array.  Otherwise, it will return the original body string.
+array.  Otherwise, it will return the original body string.</p>
 
-The original response body, headers, and status can be accessed via their
-respective methods.
+<p>The original response body, headers, and status can be accessed via their
+respective methods.</p>
 
-### OAuth2::AccessToken
+<h3 id="oauth2accesstoken">OAuth2::AccessToken</h3>
 
-If you have an existing Access Token for a user, you can initialize an instance
-using various class methods including the standard new, `from_hash` (if you have
-a hash of the values), or `from_kvform` (if you have an
-`application/x-www-form-urlencoded` encoded string of the values).
+<p>If you have an existing Access Token for a user, you can initialize an instance
+using various class methods including the standard new, <code>from_hash</code> (if you have
+a hash of the values), or <code>from_kvform</code> (if you have an
+<code>application/x-www-form-urlencoded</code> encoded string of the values).</p>
+
+<p>Options (since v2.0.x unless noted):</p>
+
+<ul>
+  <li>
+    <table>
+      <tbody>
+        <tr>
+          <td>
+<code>expires_latency</code> (Integer</td>
+          <td>nil): Seconds to subtract from expires_in when computing #expired? to offset latency.</td>
+        </tr>
+      </tbody>
+    </table>
+  </li>
+  <li>
+    <table>
+      <tbody>
+        <tr>
+          <td>
+<code>token_name</code> (String</td>
+          <td>Symbol</td>
+          <td>nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).</td>
+        </tr>
+      </tbody>
+    </table>
+  </li>
+  <li>
+    <table>
+      <tbody>
+        <tr>
+          <td>
+<code>mode</code> (Symbol</td>
+          <td>Proc</td>
+          <td>Hash): Controls how the token is transmitted on requests made via this AccessToken instance.</td>
+        </tr>
+      </tbody>
+    </table>
+    <ul>
+      <li>
+<code>:header</code> — Send as Authorization: Bearer <token> header (default and preferred by OAuth 2.1 draft guidance).</token>
+</li>
+      <li>
+<code>:query</code> — Send as access_token query parameter (discouraged in general, but required by some providers).</li>
+      <li>Verb-dependent (since v2.0.15): Provide either:
+        <ul>
+          <li>a <code>Proc</code> taking <code>|verb|</code> and returning <code>:header</code> or <code>:query</code>, or</li>
+          <li>a <code>Hash</code> with verb symbols as keys, for example <code>{get: :query, post: :header, delete: :header}</code>.</li>
+        </ul>
+      </li>
+    </ul>
+  </li>
+</ul>
 
-Options (since v2.0.x unless noted):
-- `expires_latency` (Integer | nil): Seconds to subtract from expires_in when computing #expired? to offset latency.
-- `token_name` (String | Symbol | nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).
-- `mode` (Symbol | Proc | Hash): Controls how the token is transmitted on requests made via this AccessToken instance.
-  - `:header` — Send as Authorization: Bearer <token> header (default and preferred by OAuth 2.1 draft guidance).
-  - `:query` — Send as access_token query parameter (discouraged in general, but required by some providers).
-  - Verb-dependent (since v2.0.15): Provide either:
-    - a `Proc` taking `|verb|` and returning `:header` or `:query`, or
-    - a `Hash` with verb symbols as keys, for example `:query, post: :header, delete: :header`.
+<p>Note: Verb-dependent mode supports providers like Instagram that require query mode for <code>GET</code> and header mode for <code>POST</code>/<code>DELETE</code></p>
 
-Note: Verb-dependent mode supports providers like Instagram that require query mode for `GET` and header mode for `POST`/`DELETE`
-- Verb-dependent mode via `Proc` was added in v2.0.15
-- Verb-dependent mode via `Hash` was added in v2.0.16
+<ul>
+  <li>Verb-dependent mode via <code>Proc</code> was added in v2.0.15</li>
+  <li>Verb-dependent mode via <code>Hash</code> was added in v2.0.16</li>
+</ul>
 
-### OAuth2::Error
+<h3 id="oauth2error">OAuth2::Error</h3>
 
-On 400+ status code responses, an `OAuth2::Error` will be raised.  If it is a
-standard OAuth2 error response, the body will be parsed and `#code` and `#description` will contain the values provided from the error and
-`error_description` parameters.  The `#response` property of `OAuth2::Error` will
-always contain the `OAuth2::Response` instance.
+<p>On 400+ status code responses, an <code>OAuth2::Error</code> will be raised.  If it is a
+standard OAuth2 error response, the body will be parsed and <code>#code</code> and <code>#description</code> will contain the values provided from the error and
+<code>error_description</code> parameters.  The <code>#response</code> property of <code>OAuth2::Error</code> will
+always contain the <code>OAuth2::Response</code> instance.</p>
 
-If you do not want an error to be raised, you may use `:raise_errors =&gt; false`
-option on initialization of the client.  In this case the `OAuth2::Response`
+<p>If you do not want an error to be raised, you may use <code>:raise_errors =&gt; false</code>
+option on initialization of the client.  In this case the <code>OAuth2::Response</code>
 instance will be returned as usual and on 400+ status code responses, the
-Response instance will contain the `OAuth2::Error` instance.
-
-### Authorization Grants
-
-Note on OAuth 2.1 (draft):
-- PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.
-- Redirect URIs must be compared using exact string matching by the Authorization Server.
-- The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.
-- Bearer tokens in the query string are omitted due to security risks; prefer Authorization header usage.
-- Refresh tokens for public clients must either be sender-constrained (e.g., DPoP/MTLS) or one-time use.
-- The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.
-
-References:
-- OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
-- Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
-- FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1
-- Okta: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs
-- Video: https://www.youtube.com/watch?v=g_aVPdwBTfw
-- Differences overview: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/
-
-Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
+Response instance will contain the <code>OAuth2::Error</code> instance.</p>
+
+<h3 id="authorization-grants">Authorization Grants</h3>
+
+<p>Note on OAuth 2.1 (draft):</p>
+
+<ul>
+  <li>PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.</li>
+  <li>Redirect URIs must be compared using exact string matching by the Authorization Server.</li>
+  <li>The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.</li>
+  <li>Bearer tokens in the query string are omitted due to security risks; prefer Authorization header usage.</li>
+  <li>Refresh tokens for public clients must either be sender-constrained (e.g., DPoP/MTLS) or one-time use.</li>
+  <li>The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.</li>
+</ul>
+
+<p>References:</p>
+
+<ul>
+  <li>OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13</li>
+  <li>Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1</li>
+  <li>FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1</li>
+  <li>Okta: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs</li>
+  <li>Video: https://www.youtube.com/watch?v=g_aVPdwBTfw</li>
+  <li>Differences overview: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/</li>
+</ul>
+
+<p>Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
 authentication grant types have helper strategy classes that simplify client
-use. They are available via the [`#auth_code`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
-[`#implicit`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb),
-[`#password`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/password.rb),
-[`#client_credentials`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb), and
-[`#assertion`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
-
-These aren't full examples, but demonstrative of the differences between usage for each strategy.
-```ruby
-auth_url = client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth/callback")
-access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback")
-
-auth_url = client.implicit.authorize_url(redirect_uri: "http://localhost:8080/oauth/callback")
+use. They are available via the <a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb"><code>#auth_code</code></a>,
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb"><code>#implicit</code></a>,
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/password.rb"><code>#password</code></a>,
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb"><code>#client_credentials</code></a>, and
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb"><code>#assertion</code></a> methods respectively.</p>
+
+<p>These aren’t full examples, but demonstrative of the differences between usage for each strategy.</p>
+
+<p>```ruby
+auth_url = client.auth_code.authorize_url(redirect_uri: “http://localhost:8080/oauth/callback”)
+access = client.auth_code.get_token(“code_value”, redirect_uri: “http://localhost:8080/oauth/callback”)</p>
+
+<p>auth_url = client.implicit.authorize_url(redirect_uri: “http://localhost:8080/oauth/callback”)
 # get the token params in the callback and
-access = OAuth2::AccessToken.from_kvform(client, query_string)
+access = OAuth2::AccessToken.from_kvform(client, query_string)</p>
 
-access = client.password.get_token("username", "password")
+<p>access = client.password.get_token(“username”, “password”)</p>
 
-access = client.client_credentials.get_token
+<p>access = client.client_credentials.get_token</p>
 
-# Client Assertion Strategy
-# see: https://tools.ietf.org/html/rfc7523
+<h1 id="client-assertion-strategy">Client Assertion Strategy</h1>
+<p># see: https://tools.ietf.org/html/rfc7523
 claimset = {
-  iss: "http://localhost:3001",
-  aud: "http://localhost:8080/oauth2/token",
-  sub: "me@example.com",
+  iss: “http://localhost:3001”,
+  aud: “http://localhost:8080/oauth2/token”,
+  sub: “me@example.com”,
   exp: Time.now.utc.to_i + 3600,
 }
-assertion_params = [claimset, "HS256", "secret_key"]
-access = client.assertion.get_token(assertion_params)
+assertion_params = [claimset, “HS256”, “secret_key”]
+access = client.assertion.get_token(assertion_params)</p>
 
-# The `access` (i.e. access token) is then used like so:
-access.token # actual access_token string, if you need it somewhere
-access.get("/api/stuff") # making api calls with access token
-```
+<h1 id="the-access-ie-access-token-is-then-used-like-so">The <code>access</code> (i.e. access token) is then used like so:</h1>
+<p>access.token # actual access_token string, if you need it somewhere
+access.get(“/api/stuff”) # making api calls with access token
+```</p>
 
-If you want to specify additional headers to be sent out with the
-request, add a 'headers' hash under 'params':
+<p>If you want to specify additional headers to be sent out with the
+request, add a ‘headers’ hash under ‘params’:</p>
 
-```ruby
-access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback", headers: =&gt; "Header")
-```
+<p><code>ruby
+access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback", headers: {"Some" =&gt; "Header"})
+</code></p>
 
-You can always use the `#request` method on the `OAuth2::Client` instance to make
-requests for tokens for any Authentication grant type.
+<p>You can always use the <code>#request</code> method on the <code>OAuth2::Client</code> instance to make
+requests for tokens for any Authentication grant type.</p>
 
-## 📘 Comprehensive Usage
+<h2 id="comprehensive-usage">📘 Comprehensive Usage</h2>
 
-### Common Flows (end-to-end)
+<h3 id="common-flows-end-to-end">Common Flows (end-to-end)</h3>
 
-- Authorization Code (server-side web app):
+<ul>
+  <li>Authorization Code (server-side web app):</li>
+</ul>
 
-```ruby
-require "oauth2"
+<p>```ruby
+require “oauth2”
 client = OAuth2::Client.new(
-  ENV["CLIENT_ID"],
-  ENV["CLIENT_SECRET"],
-  site: "https://provider.example.com",
-  redirect_uri: "https://my.app.example.com/oauth/callback",
-)
-
-# Step 1: redirect user to consent
-state = SecureRandom.hex(16)
-auth_url = client.auth_code.authorize_url(scope: "openid profile email", state: state)
-# redirect_to auth_url
-
-# Step 2: handle the callback
-# params[:code], params[:state]
-raise "state mismatch" unless params[:state] == state
-access = client.auth_code.get_token(params[:code])
+  ENV[“CLIENT_ID”],
+  ENV[“CLIENT_SECRET”],
+  site: “https://provider.example.com”,
+  redirect_uri: “https://my.app.example.com/oauth/callback”,
+)</p>
+
+<h1 id="step-1-redirect-user-to-consent">Step 1: redirect user to consent</h1>
+<p>state = SecureRandom.hex(16)
+auth_url = client.auth_code.authorize_url(scope: “openid profile email”, state: state)
+# redirect_to auth_url</p>
+
+<h1 id="step-2-handle-the-callback">Step 2: handle the callback</h1>
+<p># params[:code], params[:state]
+raise “state mismatch” unless params[:state] == state
+access = client.auth_code.get_token(params[:code])</p>
+
+<h1 id="step-3-call-apis">Step 3: call APIs</h1>
+<p>profile = access.get(“/api/v1/me”).parsed
+```</p>
 
-# Step 3: call APIs
-profile = access.get("/api/v1/me").parsed
-```
-
-- Client Credentials (machine-to-machine):
+<ul>
+  <li>Client Credentials (machine-to-machine):</li>
+</ul>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(ENV["CLIENT_ID"], ENV["CLIENT_SECRET"], site: "https://provider.example.com")
 access = client.client_credentials.get_token(audience: "https://api.example.com")
 resp = access.get("/v1/things")
-```
+</code></p>
 
-- Resource Owner Password (legacy; avoid when possible):
+<ul>
+  <li>Resource Owner Password (legacy; avoid when possible):</li>
+</ul>
 
-```ruby
+<p><code>ruby
 access = client.password.get_token("jdoe", "s3cret", scope: "read")
-```
+</code></p>
 
-#### Examples
+<h4 id="examples">Examples</h4>
 
 <details>
-<summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
+  <summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
 
-```ruby
+  <p>```ruby
 # This converts a Postman/Net::HTTP multipart token request to oauth2 gem usage.
 # JHipster UAA typically exposes the token endpoint at /uaa/oauth/token.
 # The original snippet included:
 # - Basic Authorization header for the client (web_app:changeit)
 # - X-XSRF-TOKEN header from a cookie (some deployments require it)
 # - grant_type=password with username/password and client_id
-# Using oauth2 gem, you don't need to build multipart bodies; the gem sends
-# application/x-www-form-urlencoded as required by RFC 6749.
+# Using oauth2 gem, you don’t need to build multipart bodies; the gem sends
+# application/x-www-form-urlencoded as required by RFC 6749.</p>
 
-require "oauth2"
+  <p>require “oauth2”</p>
 
-client = OAuth2::Client.new(
-  "web_app",            # client_id
-  "changeit",           # client_secret
-  site: "http://localhost:8080/uaa",
-  token_url: "/oauth/token",      # absolute under site (or "oauth/token" relative)
+  <p>client = OAuth2::Client.new(
+  “web_app”,            # client_id
+  “changeit”,           # client_secret
+  site: “http://localhost:8080/uaa”,
+  token_url: “/oauth/token”,      # absolute under site (or “oauth/token” relative)
   auth_scheme: :basic_auth,         # sends HTTP Basic Authorization header
-)
+)</p>
 
-# If your UAA requires an XSRF header for the token call, provide it as a header.
-# Often this is not required for token endpoints, but if your gateway enforces it,
+  <h1 id="if-your-uaa-requires-an-xsrf-header-for-the-token-call-provide-it-as-a-header">If your UAA requires an XSRF header for the token call, provide it as a header.</h1>
+  <p># Often this is not required for token endpoints, but if your gateway enforces it,
 # obtain the value from the XSRF-TOKEN cookie and pass it here.
-xsrf_token = ENV["X_XSRF_TOKEN"] # e.g., pulled from a prior set-cookie value
+xsrf_token = ENV[“X_XSRF_TOKEN”] # e.g., pulled from a prior set-cookie value</p>
 
-access = client.password.get_token(
-  "admin",                 # username
-  "admin",                 # password
-  headers: xsrf_token ? =&gt; xsrf_token : {},
+  <p>access = client.password.get_token(
+  “admin”,                 # username
+  “admin”,                 # password
+  headers: xsrf_token ? {”X-XSRF-TOKEN” =&gt; xsrf_token} : {},
   # JHipster commonly also accepts/needs the client_id in the body; include if required:
-  # client_id: "web_app",
-)
+  # client_id: “web_app”,
+)</p>
 
-puts access.token
+  <p>puts access.token
 puts access.to_hash # full token response
-```
+```</p>
 
-Notes:
-- Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.
-- If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often "/" or a login page) and pass it to headers.
-- For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.
+  <p>Notes:</p>
+
+  <ul>
+    <li>Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.</li>
+    <li>If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often “/” or a login page) and pass it to headers.</li>
+    <li>For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.</li>
+  </ul>
 
 </details>
 
-### Instagram API (verb‑dependent token mode)
+<h3 id="instagram-api-verbdependent-token-mode">Instagram API (verb‑dependent token mode)</h3>
+
+<p>Providers like Instagram require the access token to be sent differently depending on the HTTP verb:</p>
 
-Providers like Instagram require the access token to be sent differently depending on the HTTP verb:
-- GET requests: token must be in the query string (?access_token=...)
-- POST/DELETE requests: token must be in the Authorization header (Bearer ...)
+<ul>
+  <li>GET requests: token must be in the query string (?access_token=…)</li>
+  <li>POST/DELETE requests: token must be in the Authorization header (Bearer …)</li>
+</ul>
 
-Since v2.0.15, you can configure an AccessToken with a verb‑dependent mode. The gem will choose how to send the token based on the request method.
+<p>Since v2.0.15, you can configure an AccessToken with a verb‑dependent mode. The gem will choose how to send the token based on the request method.</p>
 
-Example: exchanging and refreshing long‑lived Instagram tokens, and making API calls
+<p>Example: exchanging and refreshing long‑lived Instagram tokens, and making API calls</p>
 
-```ruby
-require "oauth2"
+<p>```ruby
+require “oauth2”</p>
 
-# NOTE: Users authenticate via Facebook Login to obtain a short‑lived user token (not shown here).
-# See Facebook Login docs for obtaining the initial short‑lived token.
+<h1 id="note-users-authenticate-via-facebook-login-to-obtain-a-shortlived-user-token-not-shown-here">NOTE: Users authenticate via Facebook Login to obtain a short‑lived user token (not shown here).</h1>
+<p># See Facebook Login docs for obtaining the initial short‑lived token.</p>
 
-client = OAuth2::Client.new(nil, nil, site: "https://graph.instagram.com")
+<p>client = OAuth2::Client.new(nil, nil, site: “https://graph.instagram.com”)</p>
 
-# Start with a short‑lived token you already obtained via Facebook Login
-short_lived = OAuth2::AccessToken.new(
+<h1 id="start-with-a-shortlived-token-you-already-obtained-via-facebook-login">Start with a short‑lived token you already obtained via Facebook Login</h1>
+<p>short_lived = OAuth2::AccessToken.new(
   client,
-  ENV["IG_SHORT_LIVED_TOKEN"],
+  ENV[“IG_SHORT_LIVED_TOKEN”],
   # Key part: verb‑dependent mode
-  mode: :query, post: :header, delete: :header,
-)
+  mode: {get: :query, post: :header, delete: :header},
+)</p>
 
-# 1) Exchange for a long‑lived token (Instagram requires GET with access_token in query)
-#    Endpoint: GET https://graph.instagram.com/access_token
+<h1 id="exchange-for-a-longlived-token-instagram-requires-get-with-accesstoken-in-query">1) Exchange for a long‑lived token (Instagram requires GET with access_token in query)</h1>
+<p>#    Endpoint: GET https://graph.instagram.com/access_token
 #    Params: grant_type=ig_exchange_token, client_secret=APP_SECRET
 exchange = short_lived.get(
-  "/access_token",
+  “/access_token”,
   params: {
-    grant_type: "ig_exchange_token",
-    client_secret: ENV["IG_APP_SECRET"],
+    grant_type: “ig_exchange_token”,
+    client_secret: ENV[“IG_APP_SECRET”],
     # access_token param will be added automatically by the AccessToken (mode =&gt; :query for GET)
   },
 )
-long_lived_token_value = exchange.parsed["access_token"]
+long_lived_token_value = exchange.parsed[“access_token”]</p>
 
-long_lived = OAuth2::AccessToken.new(
+<p>long_lived = OAuth2::AccessToken.new(
   client,
   long_lived_token_value,
-  mode: :query, post: :header, delete: :header,
-)
+  mode: {get: :query, post: :header, delete: :header},
+)</p>
 
-# 2) Refresh the long‑lived token (Instagram uses GET with token in query)
-#    Endpoint: GET https://graph.instagram.com/refresh_access_token
+<h1 id="refresh-the-longlived-token-instagram-uses-get-with-token-in-query">2) Refresh the long‑lived token (Instagram uses GET with token in query)</h1>
+<p>#    Endpoint: GET https://graph.instagram.com/refresh_access_token
 refresh_resp = long_lived.get(
-  "/refresh_access_token",
-  params: "ig_refresh_token",
+  “/refresh_access_token”,
+  params: {grant_type: “ig_refresh_token”},
 )
 long_lived = OAuth2::AccessToken.new(
   client,
-  refresh_resp.parsed["access_token"],
-  mode: :query, post: :header, delete: :header,
-)
+  refresh_resp.parsed[“access_token”],
+  mode: {get: :query, post: :header, delete: :header},
+)</p>
 
-# 3) Typical API GET request (token in query automatically)
-me = long_lived.get("/me", params: "id,username").parsed
+<h1 id="typical-api-get-request-token-in-query-automatically">3) Typical API GET request (token in query automatically)</h1>
+<p>me = long_lived.get(“/me”, params: {fields: “id,username”}).parsed</p>
 
-# 4) Example POST (token sent via Bearer header automatically)
-# Note: Replace the path/params with a real Instagram Graph API POST you need,
+<h1 id="example-post-token-sent-via-bearer-header-automatically">4) Example POST (token sent via Bearer header automatically)</h1>
+<p># Note: Replace the path/params with a real Instagram Graph API POST you need,
 # such as publishing media via the Graph API endpoints.
-# long_lived.post("/me/media", body: "https://...", caption: "hello")
-```
+# long_lived.post(“/me/media”, body: {image_url: “https://…”, caption: “hello”})
+```</p>
 
-Tips:
-- Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for GET.
-- If you need a custom rule, you can pass a Proc for mode, e.g. mode: -&gt;(verb) { verb == :get ? :query : :header }.
+<p>Tips:</p>
 
-### Refresh Tokens
+<ul>
+  <li>Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for <code>GET</code> requests.</li>
+  <li>If you need a custom rule, you can pass a <code>Proc</code> for <code>mode</code>, e.g. <code>mode: -&gt;(verb) { verb == :get ? :query : :header }</code>.</li>
+</ul>
 
-When the server issues a refresh_token, you can refresh manually or implement an auto-refresh wrapper.
+<h3 id="refresh-tokens">Refresh Tokens</h3>
 
-- Manual refresh:
+<p>When the server issues a refresh_token, you can refresh manually or implement an auto-refresh wrapper.</p>
 
-```ruby
+<ul>
+  <li>Manual refresh:</li>
+</ul>
+
+<p><code>ruby
 if access.expired?
   access = access.refresh
 end
-```
+</code></p>
 
-- Auto-refresh wrapper pattern:
+<ul>
+  <li>Auto-refresh wrapper pattern:</li>
+</ul>
 
-```ruby
+<p>```ruby
 class AutoRefreshingToken
   def initialize(token_provider, store: nil)
     @token = token_provider
     @store = store # e.g., something that responds to read/write for token data
-  end
+  end</p>
 
-  def with(&amp;blk)
+<p>def with(&amp;blk)
     tok = ensure_fresh!
     blk ? blk.call(tok) : tok
   rescue OAuth2::Error =&gt; e
@@ -1088,180 +1223,193 @@ <h3 id="quick-examples">Quick Examples</h3>
       retry
     end
     raise
-  end
+  end</p>
 
-private
+<p>private</p>
 
-  def ensure_fresh!
+<p>def ensure_fresh!
     if @token.expired? &amp;&amp; @token.refresh_token
       @token = @token.refresh
       @store.write(@token.to_hash) if @store
     end
     @token
   end
-end
+end</p>
 
-# usage
-keeper = AutoRefreshingToken.new(access)
-keeper.with { |tok| tok.get("/v1/protected") }
-```
+<h1 id="usage">usage</h1>
+<p>keeper = AutoRefreshingToken.new(access)
+keeper.with { |tok| tok.get(“/v1/protected”) }
+```</p>
 
-Persist the token across processes using `AccessToken#to_hash` and `AccessToken.from_hash(client, hash)`.
+<p>Persist the token across processes using <code>AccessToken#to_hash</code> and <code>AccessToken.from_hash(client, hash)</code>.</p>
 
-### Token Revocation (RFC 7009)
+<h3 id="token-revocation-rfc-7009">Token Revocation (RFC 7009)</h3>
 
-You can revoke either the access token or the refresh token.
+<p>You can revoke either the access token or the refresh token.</p>
 
-```ruby
+<p>```ruby
 # Revoke the current access token
-access.revoke(token_type_hint: :access_token)
+access.revoke(token_type_hint: :access_token)</p>
 
-# Or explicitly revoke the refresh token (often also invalidates associated access tokens)
-access.revoke(token_type_hint: :refresh_token)
-```
+<h1 id="or-explicitly-revoke-the-refresh-token-often-also-invalidates-associated-access-tokens">Or explicitly revoke the refresh token (often also invalidates associated access tokens)</h1>
+<p>access.revoke(token_type_hint: :refresh_token)
+```</p>
 
-### Client Configuration Tips
+<h3 id="client-configuration-tips">Client Configuration Tips</h3>
 
-#### Mutual TLS (mTLS) client authentication
+<h4 id="mutual-tls-mtls-client-authentication">Mutual TLS (mTLS) client authentication</h4>
 
-Some providers require OAuth requests (including the token request and subsequent API calls) to be sender‑constrained using mutual TLS (mTLS). With this gem, you enable mTLS by providing a client certificate/private key to Faraday via connection_opts.ssl and, if your provider requires it for client authentication, selecting the tls_client_auth auth_scheme.
+<p>Some providers require OAuth requests (including the token request and subsequent API calls) to be sender‑constrained using mutual TLS (mTLS). With this gem, you enable mTLS by providing a client certificate/private key to Faraday via connection_opts.ssl and, if your provider requires it for client authentication, selecting the tls_client_auth auth_scheme.</p>
 
-Example using PEM files (certificate and key):
+<p>Example using PEM files (certificate and key):</p>
 
-```ruby
-require "oauth2"
-require "openssl"
+<p>```ruby
+require “oauth2”
+require “openssl”</p>
 
-client = OAuth2::Client.new(
-  ENV.fetch("CLIENT_ID"),
-  ENV.fetch("CLIENT_SECRET"),
-  site: "https://example.com",
-  authorize_url: "/oauth/authorize/",
-  token_url: "/oauth/token/",
+<p>client = OAuth2::Client.new(
+  ENV.fetch(“CLIENT_ID”),
+  ENV.fetch(“CLIENT_SECRET”),
+  site: “https://example.com”,
+  authorize_url: “/oauth/authorize/”,
+  token_url: “/oauth/token/”,
   auth_scheme: :tls_client_auth, # if your AS requires mTLS-based client authentication
   connection_opts: {
     ssl: {
-      client_cert: OpenSSL::X509::Certificate.new(File.read("localhost.pem")),
-      client_key: OpenSSL::PKey::RSA.new(File.read("localhost-key.pem")),
+      client_cert: OpenSSL::X509::Certificate.new(File.read(“localhost.pem”)),
+      client_key: OpenSSL::PKey::RSA.new(File.read(“localhost-key.pem”)),
       # Optional extras, uncomment as needed:
-      # ca_file: "/path/to/ca-bundle.pem",   # custom CA(s)
+      # ca_file: “/path/to/ca-bundle.pem”,   # custom CA(s)
       # verify: true                           # enable server cert verification (recommended)
     },
   },
-)
+)</p>
+
+<h1 id="example-token-request-any-grant-type-can-be-used-the-mtls-handshake">Example token request (any grant type can be used). The mTLS handshake</h1>
+<p># will occur automatically on HTTPS calls using the configured cert/key.
+access = client.client_credentials.get_token</p>
+
+<h1 id="subsequent-resource-requests-will-also-use-mtls-on-https-endpoints-of-site">Subsequent resource requests will also use mTLS on HTTPS endpoints of <code>site</code>:</h1>
+<p>resp = access.get(“/v1/protected”)
+```</p>
 
-# Example token request (any grant type can be used). The mTLS handshake
-# will occur automatically on HTTPS calls using the configured cert/key.
-access = client.client_credentials.get_token
-
-# Subsequent resource requests will also use mTLS on HTTPS endpoints of `site`:
-resp = access.get("/v1/protected")
-```
-
-Notes:
-- Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"]).
-- If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
-  - p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])
-  - client_cert = p12.certificate; client_key = p12.key
-- Server trust:
-  - If your environment does not have system CAs, specify ca_file or ca_path inside the ssl: hash.
-  - Keep verify: true in production. Set verify: false only for local testing.
-- Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. net_http (default) and net_http_persistent are common choices.
-- Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).
-- OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via auth_scheme: :tls_client_auth as shown above.
-
-#### Authentication schemes for the token request
-
-```ruby
+<p>Notes:</p>
+
+<ul>
+  <li>Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to <code>OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"])</code>.</li>
+  <li>If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
+    <ul>
+      <li><code>p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])</code></li>
+      <li><code>client_cert = p12.certificate; client_key = p12.key</code></li>
+    </ul>
+  </li>
+  <li>Server trust:
+    <ul>
+      <li>If your environment does not have system CAs, specify <code>ca_file</code> or <code>ca_path</code> inside the <code>ssl:</code> hash.</li>
+      <li>Keep <code>verify: true</code> in production. Set <code>verify: false</code> only for local testing.</li>
+    </ul>
+  </li>
+  <li>Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. <code>net_http</code> (default) and <code>net_http_persistent</code> are common choices.</li>
+  <li>Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).</li>
+  <li>OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via <code>auth_scheme: :tls_client_auth</code> as shown above.</li>
+</ul>
+
+<h4 id="authentication-schemes-for-the-token-request">Authentication schemes for the token request</h4>
+
+<p><code>ruby
 OAuth2::Client.new(
   id,
   secret,
   site: "https://provider.example.com",
   auth_scheme: :basic_auth, # default. Alternatives: :request_body, :tls_client_auth, :private_key_jwt
 )
-```
+</code></p>
 
-#### Faraday connection, timeouts, proxy, custom adapter/middleware:
+<h4 id="faraday-connection-timeouts-proxy-custom-adaptermiddleware">Faraday connection, timeouts, proxy, custom adapter/middleware:</h4>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(
   id,
   secret,
   site: "https://provider.example.com",
   connection_opts: {
-    request: 5, timeout: 15,
+    request: {open_timeout: 5, timeout: 15},
     proxy: ENV["HTTPS_PROXY"],
-    ssl: true,
+    ssl: {verify: true},
   },
 ) do |faraday|
   faraday.request(:url_encoded)
   # faraday.response :logger, Logger.new($stdout) # see OAUTH_DEBUG below
   faraday.adapter(:net_http_persistent) # or any Faraday adapter you need
 end
-```
+</code></p>
 
-##### Using flat query params (Faraday::FlatParamsEncoder)
+<h5 id="using-flat-query-params-faradayflatparamsencoder">Using flat query params (<code>Faraday::FlatParamsEncoder</code>)</h5>
 
-Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides FlatParamsEncoder for this purpose. You can configure the oauth2 client to use it when building requests.
+<p>Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides <code>FlatParamsEncoder</code> for this purpose. You can configure the oauth2 client to use it when building requests.</p>
 
-```ruby
-require "faraday"
+<p>```ruby
+require “faraday”</p>
 
-client = OAuth2::Client.new(
+<p>client = OAuth2::Client.new(
   id,
   secret,
-  site: "https://api.example.com",
+  site: “https://api.example.com”,
   # Pass Faraday connection options to make FlatParamsEncoder the default
   connection_opts: {
-    request: Faraday::FlatParamsEncoder,
+    request: {params_encoder: Faraday::FlatParamsEncoder},
   },
 ) do |faraday|
   faraday.request(:url_encoded)
   faraday.adapter(:net_http)
-end
+end</p>
 
-access = client.client_credentials.get_token
+<p>access = client.client_credentials.get_token</p>
 
-# Example of a GET with two flat filter params (not an array):
-# Results in: ?filter=order.clientCreatedTime%3E1445006997000&amp;filter=order.clientCreatedTime%3C1445611797000
+<h1 id="example-of-a-get-with-two-flat-filter-params-not-an-array">Example of a GET with two flat filter params (not an array):</h1>
+<p># Results in: ?filter=order.clientCreatedTime%3E1445006997000&amp;filter=order.clientCreatedTime%3C1445611797000
 resp = access.get(
-  "/v1/orders",
+  “/v1/orders”,
   params: {
     # Provide the values as an array; FlatParamsEncoder expands them as repeated keys
     filter: [
-      "order.clientCreatedTime&gt;1445006997000",
-      "order.clientCreatedTime&lt;1445611797000",
+      “order.clientCreatedTime&gt;1445006997000”,
+      “order.clientCreatedTime&lt;1445611797000”,
     ],
   },
 )
-```
+```</p>
 
-If you instead need to build a raw Faraday connection yourself, the equivalent configuration is:
+<p>If you instead need to build a raw Faraday connection yourself, the equivalent configuration is:</p>
 
-```ruby
-conn = Faraday.new("https://api.example.com", request: Faraday::FlatParamsEncoder)
-```
+<p><code>ruby
+conn = Faraday.new("https://api.example.com", request: {params_encoder: Faraday::FlatParamsEncoder})
+</code></p>
 
-#### Redirection
+<h4 id="redirection">Redirection</h4>
 
-The library follows up to `max_redirects` (default 5).
-You can override per-client via `options[:max_redirects]`.
+<p>The library follows up to <code>max_redirects</code> (default 5).
+You can override per-client via <code>options[:max_redirects]</code>.</p>
 
-### Handling Responses and Errors
+<h3 id="handling-responses-and-errors">Handling Responses and Errors</h3>
 
-- Parsing:
+<ul>
+  <li>Parsing:</li>
+</ul>
 
-```ruby
+<p><code>ruby
 resp = access.get("/v1/thing")
 resp.status     # Integer
 resp.headers    # Hash
 resp.body       # String
 resp.parsed     # SnakyHash::StringKeyed or Array when JSON array
-```
+</code></p>
 
-- Error handling:
+<ul>
+  <li>Error handling:</li>
+</ul>
 
-```ruby
+<p><code>ruby
 begin
   access.get("/v1/forbidden")
 rescue OAuth2::Error =&gt; e
@@ -1269,150 +1417,155 @@ <h3 id="quick-examples">Quick Examples</h3>
   e.description  # OAuth2 error description (when present)
   e.response     # OAuth2::Response (full access to status/headers/body)
 end
-```
+</code></p>
 
-- Disable raising on 4xx/5xx to inspect the response yourself:
+<ul>
+  <li>Disable raising on 4xx/5xx to inspect the response yourself:</li>
+</ul>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(id, secret, site: site, raise_errors: false)
 res = client.request(:get, "/v1/maybe-errors")
 if res.status == 429
   sleep res.headers["retry-after"].to_i
 end
-```
+</code></p>
 
-### Making Raw Token Requests
+<h3 id="making-raw-token-requests">Making Raw Token Requests</h3>
 
-If a provider requires non-standard parameters or headers, you can call `client.get_token` directly:
+<p>If a provider requires non-standard parameters or headers, you can call <code>client.get_token</code> directly:</p>
 
-```ruby
+<p><code>ruby
 access = client.get_token({
   grant_type: "client_credentials",
   audience: "https://api.example.com",
-  headers: =&gt; "value",
+  headers: {"X-Custom" =&gt; "value"},
   parse: :json, # override parsing
 })
-```
+</code></p>
 
-### OpenID Connect (OIDC) Notes
+<h3 id="openid-connect-oidc-notes">OpenID Connect (OIDC) Notes</h3>
 
-- If the token response includes an `id_token` (a JWT), this gem surfaces it but does not validate the signature. Use a JWT library and your provider's JWKs to verify it.
-- For private_key_jwt client authentication, provide `auth_scheme: :private_key_jwt` and ensure your key configuration matches the provider requirements.
-- See [OIDC.md](OIDC.md) for a more complete OIDC overview, example, and links to the relevant specifications.
+<ul>
+  <li>If the token response includes an <code>id_token</code> (a JWT), this gem surfaces it but does not validate the signature. Use a JWT library and your provider’s JWKs to verify it.</li>
+  <li>For private_key_jwt client authentication, provide <code>auth_scheme: :private_key_jwt</code> and ensure your key configuration matches the provider requirements.</li>
+  <li>See <a href="OIDC.md">OIDC.md</a> for a more complete OIDC overview, example, and links to the relevant specifications.</li>
+</ul>
 
-### Debugging
+<h3 id="debugging">Debugging</h3>
 
-- Set environment variable `OAUTH_DEBUG=true` to enable verbose Faraday logging (uses the client-provided logger).
-- To mirror a working curl request, ensure you set the same auth scheme, params, and content type. The Quick Example at the top shows a curl-to-ruby translation.
+<ul>
+  <li>Set environment variable <code>OAUTH_DEBUG=true</code> to enable verbose Faraday logging (uses the client-provided logger).</li>
+  <li>To mirror a working curl request, ensure you set the same auth scheme, params, and content type. The Quick Example at the top shows a curl-to-ruby translation.</li>
+</ul>
 
----
+<hr>
 
-## 🦷 FLOSS Funding
+<h2 id="floss-funding">🦷 FLOSS Funding</h2>
 
-While ruby-oauth tools are free software and will always be, the project would benefit immensely from some funding.
-Raising a monthly budget of... "dollars" would make the project more sustainable.
+<p>While ruby-oauth tools are free software and will always be, the project would benefit immensely from some funding.
+Raising a monthly budget of… “dollars” would make the project more sustainable.</p>
 
-We welcome both individual and corporate sponsors! We also offer a
+<p>We welcome both individual and corporate sponsors! We also offer a
 wide array of funding channels to account for your preferences
-(although currently [Open Collective][🖇osc] is our preferred funding platform).
+(although currently <a href="https://opencollective.com/ruby-oauth">Open Collective</a> is our preferred funding platform).</p>
 
-**If you're working in a company that's making significant use of ruby-oauth tools we'd
-appreciate it if you suggest to your company to become a ruby-oauth sponsor.**
+<p><strong>If you’re working in a company that’s making significant use of ruby-oauth tools we’d
+appreciate it if you suggest to your company to become a ruby-oauth sponsor.</strong></p>
 
-You can support the development of ruby-oauth tools via
-[GitHub Sponsors][🖇sponsor],
-[Liberapay][⛳liberapay],
-[PayPal][🖇paypal],
-[Open Collective][🖇osc]
-and [Tidelift][🏙️entsup-tidelift].
+<p>You can support the development of ruby-oauth tools via
+<a href="https://github.com/sponsors/pboling">GitHub Sponsors</a>,
+<a href="https://liberapay.com/pboling/donate">Liberapay</a>,
+<a href="https://www.paypal.com/paypalme/peterboling">PayPal</a>,
+<a href="https://opencollective.com/ruby-oauth">Open Collective</a>
+and <a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme">Tidelift</a>.</p>
 
-| 📍 NOTE                                                                                                                                                                                                              |
-|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| If doing a sponsorship in the form of donation is problematic for your company <br> from an accounting standpoint, we'd recommend the use of Tidelift, <br> where you can get a support-like subscription instead. |
+<table>
+  <thead>
+    <tr>
+      <th>📍 NOTE</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>If doing a sponsorship in the form of donation is problematic for your company <br> from an accounting standpoint, we’d recommend the use of Tidelift, <br> where you can get a support-like subscription instead.</td>
+    </tr>
+  </tbody>
+</table>
 
-### Open Collective for Individuals
+<h3 id="open-collective-for-individuals">Open Collective for Individuals</h3>
 
-Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/kettle-rb#backer)]
+<p>Support us with a monthly donation and help us continue our activities. [<a href="https://opencollective.com/ruby-oauth#backer">Become a backer</a>]</p>
 
-NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
+<p>NOTE: <a href="https://github.com/ruby-oauth/oauth2/blob/main/exe/kettle-readme-backers">kettle-readme-backers</a> updates this list every day, automatically.</p>
 
 <!-- OPENCOLLECTIVE-INDIVIDUALS:START -->
-No backers yet. Be the first!
-<!-- OPENCOLLECTIVE-INDIVIDUALS:END -->
+<p>No backers yet. Be the first!
+<!-- OPENCOLLECTIVE-INDIVIDUALS:END --></p>
 
-### Open Collective for Organizations
+<h3 id="open-collective-for-organizations">Open Collective for Organizations</h3>
 
-Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/kettle-rb#sponsor)]
+<p>Become a sponsor and get your logo on our README on GitHub with a link to your site. [<a href="https://opencollective.com/ruby-oauth#sponsor">Become a sponsor</a>]</p>
 
-NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
+<p>NOTE: <a href="https://github.com/ruby-oauth/oauth2/blob/main/exe/kettle-readme-backers">kettle-readme-backers</a> updates this list every day, automatically.</p>
 
 <!-- OPENCOLLECTIVE-ORGANIZATIONS:START -->
-No sponsors yet. Be the first!
-
-### Open Collective for Donors
-
-<a href="https://opencollective.com/ruby-oauth/backer/0/website" target="_blank"><img src="https://opencollective.com/ruby-oauth/backer/0/avatar.svg"></a>
+<p>No sponsors yet. Be the first!
+<!-- OPENCOLLECTIVE-ORGANIZATIONS:END --></p>
 
-<!-- OPENCOLLECTIVE-ORGANIZATIONS:END -->
+<h3 id="another-way-to-support-open-source">Another way to support open-source</h3>
 
-[kettle-readme-backers]: https://github.com/kettle-rb/kettle-dev/blob/main/exe/kettle-readme-backers
+<p>I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).</p>
 
-### Another way to support open-source
+<p>If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in <code>bundle fund</code>.</p>
 
-&gt; How wonderful it is that nobody need wait a single moment before starting to improve the world.<br>
-&gt;—Anne Frank
+<p>I’m developing a new library, <a href="https://github.com/galtzo-floss/floss_funding">floss_funding</a>, designed to empower open-source developers like myself to get paid for the work we do, in a sustainable way. Please give it a look.</p>
 
-I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions — totaling 79 hours of FLOSS coding over just the past seven days, a pretty regular week for me.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
+<p><strong><a href="https://floss-funding.dev">Floss-Funding.dev</a>: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags</strong></p>
 
-If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
+<p><a href="https://opencollective.com/ruby-oauth#backer"><img src="https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat" alt="OpenCollective Backers"></a> <a href="https://opencollective.com/ruby-oauth#sponsor"><img src="https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat" alt="OpenCollective Sponsors"></a> <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github" alt="Sponsor Me on Github"></a> <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat" alt="Liberapay Goal Progress"></a> <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal" alt="Donate on PayPal"></a> <a href="https://www.buymeacoffee.com/pboling"><img src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat" alt="Buy me a coffee"></a> <a href="https://polar.sh/pboling"><img src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat" alt="Donate on Polar"></a> <a href="https://ko-fi.com/O5O86SNP4"><img src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat" alt="Donate to my FLOSS efforts at ko-fi.com"></a> <a href="https://patreon.com/galtzo"><img src="https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat" alt="Donate to my FLOSS efforts using Patreon"></a></p>
 
-I’m developing a new library, [floss_funding][🖇floss-funding-gem], designed to empower open-source developers like myself to get paid for the work we do, in a sustainable way. Please give it a look.
+<h2 id="security">🔐 Security</h2>
 
-**[Floss-Funding.dev][🖇floss-funding.dev]: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags**
+<p>To report a security vulnerability, please use the <a href="https://tidelift.com/security">Tidelift security contact</a>.
+Tidelift will coordinate the fix and disclosure.</p>
 
-[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS or refugee efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS or refugee efforts using Patreon][🖇patreon-img]][🖇patreon]
+<p>For more see <a href="SECURITY.md">SECURITY.md</a>, <a href="THREAT_MODEL.md">THREAT_MODEL.md</a>, and <a href="IRP.md">IRP.md</a>.</p>
 
-## 🔐 Security
+<h2 id="contributing">🤝 Contributing</h2>
 
-To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
-Tidelift will coordinate the fix and disclosure.
+<p>If you need some ideas of where to help, you could work on adding more code coverage,
+or if it is already 💯 (see <a href="#code-coverage">below</a>) check <a href="REEK">reek</a>, <a href="https://github.com/ruby-oauth/oauth2/issues">issues</a>, or <a href="https://github.com/ruby-oauth/oauth2/pulls">PRs</a>,
+or use the gem and think about how it could be better.</p>
 
-For more see [SECURITY.md][🔐security], [THREAT_MODEL.md][🔐threat-model], and [IRP.md][🔐irp].
+<p>We <a href="https://keepachangelog.com/en/1.0.0/"><img src="https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat" alt="Keep A Changelog"></a> so if you make changes, remember to update it.</p>
 
-## 🤝 Contributing
+<p>See <a href="CONTRIBUTING.md">CONTRIBUTING.md</a> for more detailed instructions.</p>
 
-If you need some ideas of where to help, you could work on adding more code coverage,
-or if it is already 💯 (see [below](#code-coverage)) check [reek](REEK), [issues][🤝gh-issues], or [PRs][🤝gh-pulls],
-or use the gem and think about how it could be better.
+<h3 id="release-instructions">🚀 Release Instructions</h3>
 
-We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
+<p>See <a href="CONTRIBUTING.md">CONTRIBUTING.md</a>.</p>
 
-See [CONTRIBUTING.md][🤝contributing] for more detailed instructions.
+<h3 id="code-coverage">Code Coverage</h3>
 
-### 🚀 Release Instructions
+<p><a href="https://codecov.io/gh/ruby-oauth/oauth2"><img src="https://codecov.io/gh/ruby-oauth/oauth2/graphs/tree.svg" alt="Coverage Graph"></a></p>
 
-See [CONTRIBUTING.md][🤝contributing].
+<p><a href="https://coveralls.io/github/ruby-oauth/oauth2?branch=main"><img src="https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main" alt="Coveralls Test Coverage"></a></p>
 
-### Code Coverage
+<p><a href="https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating"><img src="https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg" alt="QLTY Test Coverage"></a></p>
 
-[![Coverage Graph][🏀codecov-g]][🏀codecov]
+<h3 id="code-of-conduct">🪇 Code of Conduct</h3>
 
-[![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls]
+<p>Everyone interacting with this project’s codebases, issue trackers,
+chat rooms and mailing lists agrees to follow the <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg" alt="Contributor Covenant 2.1"></a>.</p>
 
-[![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov]
+<h2 id="contributors">🌈 Contributors</h2>
 
-### 🪇 Code of Conduct
+<p><a href="https://github.com/ruby-oauth/oauth2/graphs/contributors"><img src="https://contrib.rocks/image?repo=ruby-oauth/oauth2" alt="Contributors"></a></p>
 
-Everyone interacting with this project's codebases, issue trackers,
-chat rooms and mailing lists agrees to follow the [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct].
+<p>Made with <a href="https://contrib.rocks">contributors-img</a>.</p>
 
-## 🌈 Contributors
-
-[![Contributors][🖐contributors-img]][🖐contributors]
-
-Made with [contributors-img][🖐contrib-rocks].
-
-Also see GitLab Contributors: [https://gitlab.com/ruby-oauth/oauth2/-/graphs/main][🚎contributors-gl]
+<p>Also see GitLab Contributors: <a href="https://gitlab.com/ruby-oauth/oauth2/-/graphs/main">https://gitlab.com/ruby-oauth/oauth2/-/graphs/main</a></p>
 
 <details>
     <summary>⭐️ Star History</summary>
@@ -1427,55 +1580,58 @@ <h3 id="quick-examples">Quick Examples</h3>
 
 </details>
 
-## 📌 Versioning
+<h2 id="versioning">📌 Versioning</h2>
 
-This Library adheres to [![Semantic Versioning 2.0.0][📌semver-img]][📌semver].
+<p>This Library adheres to <a href="https://semver.org/spec/v2.0.0.html"><img src="https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat" alt="Semantic Versioning 2.0.0"></a>.
 Violations of this scheme should be reported as bugs.
 Specifically, if a minor or patch version is released that breaks backward compatibility,
 a new version should be immediately released that restores compatibility.
-Breaking changes to the public API will only be introduced with new major versions.
+Breaking changes to the public API will only be introduced with new major versions.</p>
 
-&gt; dropping support for a platform is both obviously and objectively a breaking change <br>
-&gt;—Jordan Harband ([@ljharb](https://github.com/ljharb), maintainer of SemVer) [in SemVer issue 716][📌semver-breaking]
+<blockquote>
+  <p>dropping support for a platform is both obviously and objectively a breaking change <br>
+—Jordan Harband (<a href="https://github.com/ljharb">@ljharb</a>, maintainer of SemVer) <a href="https://github.com/semver/semver/issues/716#issuecomment-869336139">in SemVer issue 716</a></p>
+</blockquote>
 
-I understand that policy doesn't work universally ("exceptions to every rule!"),
+<p>I understand that policy doesn’t work universally (“exceptions to every rule!”),
 but it is the policy here.
 As such, in many cases it is good to specify a dependency on this library using
-the [Pessimistic Version Constraint][📌pvc] with two digits of precision.
+the <a href="http://guides.rubygems.org/patterns/#pessimistic-version-constraint">Pessimistic Version Constraint</a> with two digits of precision.</p>
 
-For example:
+<p>For example:</p>
 
-```ruby
+<p><code>ruby
 spec.add_dependency("oauth2", "~&gt; 2.0")
-```
+</code></p>
 
 <details>
-<summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
+  <summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
 
-SemVer should, IMO, but doesn't explicitly, say that dropping support for specific Platforms
-is a *breaking change* to an API.
-It is obvious to many, but not all, and since the spec is silent, the bike shedding is endless.
+  <p>SemVer should, IMO, but doesn’t explicitly, say that dropping support for specific Platforms
+is a <em>breaking change</em> to an API, and for that reason the bike shedding is endless.</p>
 
-To get a better understanding of how SemVer is intended to work over a project's lifetime,
-read this article from the creator of SemVer:
+  <p>To get a better understanding of how SemVer is intended to work over a project’s lifetime,
+read this article from the creator of SemVer:</p>
 
-- ["Major Version Numbers are Not Sacred"][📌major-versions-not-sacred]
+  <ul>
+    <li><a href="https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html">“Major Version Numbers are Not Sacred”</a></li>
+  </ul>
 
 </details>
 
-See [CHANGELOG.md][📌changelog] for a list of releases.
+<p>See <a href="CHANGELOG.md">CHANGELOG.md</a> for a list of releases.</p>
 
-## 📄 License
+<h2 id="license">📄 License</h2>
 
-The gem is available as open source under the terms of
-the [MIT License][📄license] [![License: MIT][📄license-img]][📄license-ref].
-See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright-notice-explainer].
+<p>The gem is available as open source under the terms of
+the <a href="LICENSE.txt">MIT License</a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-259D6C.svg" alt="License: MIT"></a>.
+See <a href="LICENSE.txt">LICENSE.txt</a> for the official <a href="https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year">Copyright Notice</a>.</p>
 
-### © Copyright
+<h3 id="copyright">© Copyright</h3>
 
 <ul>
     <li>
-        Copyright (c) 2017–2025 Peter H. Boling, of
+        Copyright (c) 2017 – 2025 Peter H. Boling, of
         <a href="https://discord.gg/3qme4XHNKN">
             Galtzo.com
             <picture>
@@ -1484,243 +1640,30 @@ <h3 id="quick-examples">Quick Examples</h3>
         </a>, and oauth2 contributors.
     </li>
     <li>
-        Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.
+        Copyright (c) 2011 - 2013 Michael Bleigh and Intridea, Inc.
     </li>
 </ul>
 
-## 🤑 A request for help
+<h2 id="a-request-for-help">🤑 A request for help</h2>
 
-Maintainers have teeth and need to pay their dentists.
-After getting laid off in an RIF in March and filled with many dozens of rejections,
-I'm now spending ~60+ hours a week building open source tools.
-I'm hoping to be able to pay for my kids' health insurance this month,
+<p>Maintainers have teeth and need to pay their dentists.
+After getting laid off in an RIF in March, and encountering difficulty finding a new one,
+I began spending most of my time building open source tools.
+I’m hoping to be able to pay for my kids’ health insurance this month,
 so if you value the work I am doing, I need your support.
-Please consider sponsoring me or the project.
-
-To join the community or get help 👇️ Join the Discord.
-
-[![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
-
-To say "thanks!" ☝️ Join the Discord or 👇️ send money.
-
-[![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay-img] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal-img]
-
-### Please give the project a star ⭐ ♥.
-
-Thanks for RTFM. ☺️
-
-[⛳liberapay-img]: https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat
-[⛳liberapay-bottom-img]: https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&amp;logo=liberapay&amp;color=a51611
-[⛳liberapay]: https://liberapay.com/pboling/donate
-[🖇osc-all-img]: https://img.shields.io/opencollective/all/ruby-oauth
-[🖇osc-sponsors-img]: https://img.shields.io/opencollective/sponsors/ruby-oauth
-[🖇osc-backers-img]: https://img.shields.io/opencollective/backers/ruby-oauth
-[🖇osc-backers]: https://opencollective.com/ruby-oauth#backer
-[🖇osc-backers-i]: https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat
-[🖇osc-sponsors]: https://opencollective.com/ruby-oauth#sponsor
-[🖇osc-sponsors-i]: https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat
-[🖇osc-all-bottom-img]: https://img.shields.io/opencollective/all/ruby-oauth?style=for-the-badge
-[🖇osc-sponsors-bottom-img]: https://img.shields.io/opencollective/sponsors/ruby-oauth?style=for-the-badge
-[🖇osc-backers-bottom-img]: https://img.shields.io/opencollective/backers/ruby-oauth?style=for-the-badge
-[🖇osc]: https://opencollective.com/ruby-oauth
-[🖇sponsor-img]: https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github
-[🖇sponsor-bottom-img]: https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&amp;logo=github
-[🖇sponsor]: https://github.com/sponsors/pboling
-[🖇polar-img]: https://img.shields.io/badge/polar-donate-a51611.svg?style=flat
-[🖇polar]: https://polar.sh/pboling
-[🖇kofi-img]: https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat
-[🖇kofi]: https://ko-fi.com/O5O86SNP4
-[🖇patreon-img]: https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat
-[🖇patreon]: https://patreon.com/galtzo
-[🖇buyme-small-img]: https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat
-[🖇buyme-img]: https://img.buymeacoffee.com/button-api/?text=Buy%20me%20a%20latte&amp;emoji=&amp;slug=pboling&amp;button_colour=FFDD00&amp;font_colour=000000&amp;font_family=Cookie&amp;outline_colour=000000&amp;coffee_colour=ffffff
-[🖇buyme]: https://www.buymeacoffee.com/pboling
-[🖇paypal-img]: https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal
-[🖇paypal-bottom-img]: https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&amp;logo=paypal&amp;color=0A0A0A
-[🖇paypal]: https://www.paypal.com/paypalme/peterboling
-[🖇floss-funding.dev]: https://floss-funding.dev
-[🖇floss-funding-gem]: https://github.com/galtzo-floss/floss_funding
-[✉️discord-invite]: https://discord.gg/3qme4XHNKN
-[✉️discord-invite-img-ftb]: https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord
-[✉️ruby-friends-img]: https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&amp;logo=dailydotdev&amp;logoColor=white
-[✉️ruby-friends]: https://app.daily.dev/squads/rubyfriends
-
-[⛳gg-discussions]: https://groups.google.com/g/oauth-ruby
-[⛳gg-discussions-img]: https://img.shields.io/badge/google-group-0093D0.svg?style=for-the-badge&amp;logo=google&amp;logoColor=orange
-
-[✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
-[⛳️gem-namespace]: https://github.com/ruby-oauth/oauth2
-[⛳️namespace-img]: https://img.shields.io/badge/namespace-OAuth2-3C2D2D.svg?style=square&amp;logo=ruby&amp;logoColor=white
-[⛳️gem-name]: https://rubygems.org/gems/oauth2
-[⛳️name-img]: https://img.shields.io/badge/name-oauth2-3C2D2D.svg?style=square&amp;logo=rubygems&amp;logoColor=red
-[⛳️tag-img]: https://img.shields.io/github/tag/ruby-oauth/oauth2.svg
-[⛳️tag]: http://github.com/ruby-oauth/oauth2/releases
-[🚂maint-blog]: http://www.railsbling.com/tags/oauth2
-[🚂maint-blog-img]: https://img.shields.io/badge/blog-railsbling-0093D0.svg?style=for-the-badge&amp;logo=rubyonrails&amp;logoColor=orange
-[🚂maint-contact]: http://www.railsbling.com/contact
-[🚂maint-contact-img]: https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&amp;logo=rubyonrails&amp;logoColor=red
-[💖🖇linkedin]: http://www.linkedin.com/in/peterboling
-[💖🖇linkedin-img]: https://img.shields.io/badge/PeterBoling-LinkedIn-0B66C2?style=flat&amp;logo=newjapanprowrestling
-[💖✌️wellfound]: https://wellfound.com/u/peter-boling
-[💖✌️wellfound-img]: https://img.shields.io/badge/peter--boling-orange?style=flat&amp;logo=wellfound
-[💖💲crunchbase]: https://www.crunchbase.com/person/peter-boling
-[💖💲crunchbase-img]: https://img.shields.io/badge/peter--boling-purple?style=flat&amp;logo=crunchbase
-[💖🐘ruby-mast]: https://ruby.social/@galtzo
-[💖🐘ruby-mast-img]: https://img.shields.io/mastodon/follow/109447111526622197?domain=https://ruby.social&amp;style=flat&amp;logo=mastodon&amp;label=Ruby%20@galtzo
-[💖🦋bluesky]: https://bsky.app/profile/galtzo.com
-[💖🦋bluesky-img]: https://img.shields.io/badge/@galtzo.com-0285FF?style=flat&amp;logo=bluesky&amp;logoColor=white
-[💖🌳linktree]: https://linktr.ee/galtzo
-[💖🌳linktree-img]: https://img.shields.io/badge/galtzo-purple?style=flat&amp;logo=linktree
-[💖💁🏼‍♂️devto]: https://dev.to/galtzo
-[💖💁🏼‍♂️devto-img]: https://img.shields.io/badge/dev.to-0A0A0A?style=flat&amp;logo=devdotto&amp;logoColor=white
-[💖💁🏼‍♂️aboutme]: https://about.me/peter.boling
-[💖💁🏼‍♂️aboutme-img]: https://img.shields.io/badge/about.me-0A0A0A?style=flat&amp;logo=aboutme&amp;logoColor=white
-[💖🧊berg]: https://codeberg.org/pboling
-[💖🐙hub]: https://github.org/pboling
-[💖🛖hut]: https://sr.ht/~galtzo/
-[💖🧪lab]: https://gitlab.com/pboling
-[👨🏼‍🏫expsup-upwork]: https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share
-[👨🏼‍🏫expsup-upwork-img]: https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&amp;logo=Upwork&amp;logoColor=white
-[👨🏼‍🏫expsup-codementor]: https://www.codementor.io/peterboling?utm_source=github&amp;utm_medium=button&amp;utm_term=peterboling&amp;utm_campaign=github
-[👨🏼‍🏫expsup-codementor-img]: https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&amp;logo=CodeMentor&amp;logoColor=white
-[🏙️entsup-tidelift]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme
-[🏙️entsup-tidelift-img]: https://img.shields.io/badge/Tidelift_and_Sonar-Enterprise_Support-FD3456?style=for-the-badge&amp;logo=sonar&amp;logoColor=white
-[🏙️entsup-tidelift-sonar]: https://blog.tidelift.com/tidelift-joins-sonar
-[💁🏼‍♂️peterboling]: http://www.peterboling.com
-[🚂railsbling]: http://www.railsbling.com
-[📜src-gl-img]: https://img.shields.io/badge/GitLab-FBA326?style=for-the-badge&amp;logo=Gitlab&amp;logoColor=orange
-[📜src-gl]: https://gitlab.com/ruby-oauth/oauth2/
-[📜src-cb-img]: https://img.shields.io/badge/CodeBerg-4893CC?style=for-the-badge&amp;logo=CodeBerg&amp;logoColor=blue
-[📜src-cb]: https://codeberg.org/ruby-oauth/oauth2
-[📜src-gh-img]: https://img.shields.io/badge/GitHub-238636?style=for-the-badge&amp;logo=Github&amp;logoColor=green
-[📜src-gh]: https://github.com/ruby-oauth/oauth2
-[📜docs-cr-rd-img]: https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white
-[📜docs-head-rd-img]: https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white
-[📜gl-wiki]: https://gitlab.com/ruby-oauth/oauth2/-/wikis/home
-[📜gh-wiki]: https://github.com/ruby-oauth/oauth2/wiki
-[📜gl-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=gitlab&amp;logoColor=white
-[📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=github&amp;logoColor=white
-[👽dl-rank]: https://rubygems.org/gems/oauth2
-[👽dl-ranki]: https://img.shields.io/gem/rd/oauth2.svg
-[👽oss-help]: https://www.codetriage.com/ruby-oauth/oauth2
-[👽oss-helpi]: https://www.codetriage.com/ruby-oauth/oauth2/badges/users.svg
-[👽version]: https://rubygems.org/gems/oauth2
-[👽versioni]: https://img.shields.io/gem/v/oauth2.svg
-[🏀qlty-mnt]: https://qlty.sh/gh/ruby-oauth/projects/oauth2
-[🏀qlty-mnti]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg
-[🏀qlty-cov]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating
-[🏀qlty-covi]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg
-[🏀codecov]: https://codecov.io/gh/ruby-oauth/oauth2
-[🏀codecovi]: https://codecov.io/gh/ruby-oauth/oauth2/graph/badge.svg
-[🏀coveralls]: https://coveralls.io/github/ruby-oauth/oauth2?branch=main
-[🏀coveralls-img]: https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main
-[🖐codeQL]: https://github.com/ruby-oauth/oauth2/security/code-scanning
-[🖐codeQL-img]: https://github.com/ruby-oauth/oauth2/actions/workflows/codeql-analysis.yml/badge.svg
-[🚎1-an-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml
-[🚎1-an-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml/badge.svg
-[🚎2-cov-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml
-[🚎2-cov-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml/badge.svg
-[🚎3-hd-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml
-[🚎3-hd-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml/badge.svg
-[🚎4-lg-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml
-[🚎4-lg-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml/badge.svg
-[🚎5-st-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml
-[🚎5-st-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml/badge.svg
-[🚎6-s-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml
-[🚎6-s-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml/badge.svg
-[🚎7-us-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml
-[🚎7-us-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml/badge.svg
-[🚎8-ho-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml
-[🚎8-ho-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml/badge.svg
-[🚎9-t-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml
-[🚎9-t-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml/badge.svg
-[🚎10-j-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml
-[🚎10-j-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml/badge.svg
-[🚎11-c-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml
-[🚎11-c-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml/badge.svg
-[🚎12-crh-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml
-[🚎12-crh-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml/badge.svg
-[🚎13-cbs-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/caboose.yml
-[🚎13-cbs-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/caboose.yml/badge.svg
-[🚎13-🔒️-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml
-[🚎13-🔒️-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml/badge.svg
-[🚎14-🔓️-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml
-[🚎14-🔓️-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml/badge.svg
-[🚎15-🪪-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml
-[🚎15-🪪-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml/badge.svg
-[💎ruby-2.2i]: https://img.shields.io/badge/Ruby-2.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.3i]: https://img.shields.io/badge/Ruby-2.3-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.4i]: https://img.shields.io/badge/Ruby-2.4-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.5i]: https://img.shields.io/badge/Ruby-2.5-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.6i]: https://img.shields.io/badge/Ruby-2.6-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.7i]: https://img.shields.io/badge/Ruby-2.7-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.0i]: https://img.shields.io/badge/Ruby-3.0-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.1i]: https://img.shields.io/badge/Ruby-3.1-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.2i]: https://img.shields.io/badge/Ruby-3.2-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.3i]: https://img.shields.io/badge/Ruby-3.3-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-c-i]: https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=green
-[💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue
-[💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink
-[💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink
-[💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink
-[💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=green
-[💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue
-[💎jruby-9.1i]: https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-9.2i]: https://img.shields.io/badge/JRuby-9.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-9.3i]: https://img.shields.io/badge/JRuby-9.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-9.4i]: https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-c-i]: https://img.shields.io/badge/JRuby-current-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=green
-[💎jruby-headi]: https://img.shields.io/badge/JRuby-HEAD-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue
-[🤝gh-issues]: https://github.com/ruby-oauth/oauth2/issues
-[🤝gh-pulls]: https://github.com/ruby-oauth/oauth2/pulls
-[🤝gl-issues]: https://gitlab.com/ruby-oauth/oauth2/-/issues
-[🤝gl-pulls]: https://gitlab.com/ruby-oauth/oauth2/-/merge_requests
-[🤝cb-issues]: https://codeberg.org/ruby-oauth/oauth2/issues
-[🤝cb-pulls]: https://codeberg.org/ruby-oauth/oauth2/pulls
-[🤝cb-donate]: https://donate.codeberg.org/
-[🤝contributing]: CONTRIBUTING.md
-[🏀codecov-g]: https://codecov.io/gh/ruby-oauth/oauth2/graphs/tree.svg
-[🖐contrib-rocks]: https://contrib.rocks
-[🖐contributors]: https://github.com/ruby-oauth/oauth2/graphs/contributors
-[🖐contributors-img]: https://contrib.rocks/image?repo=ruby-oauth/oauth2
-[🚎contributors-gl]: https://gitlab.com/ruby-oauth/oauth2/-/graphs/main
-[🪇conduct]: CODE_OF_CONDUCT.md
-[🪇conduct-img]: https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg
-[📌pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
-[📌semver]: https://semver.org/spec/v2.0.0.html
-[📌semver-img]: https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat
-[📌semver-breaking]: https://github.com/semver/semver/issues/716#issuecomment-869336139
-[📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
-[📌changelog]: CHANGELOG.md
-[📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
-[📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat
-[📌gitmoji]:https://gitmoji.dev
-[📌gitmoji-img]:https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
-[🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&amp;logo=YouTube&amp;logoColor=blue
-[🔐security]: SECURITY.md
-[🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
-[🔐irp]: IRP.md
-[🔐irp-img]: https://img.shields.io/badge/IRP-259D6C.svg?style=flat
-[🔐threat-model]: THREAT_MODEL.md
-[🔐threat-model-img]: https://img.shields.io/badge/threat-model-259D6C.svg?style=flat
-[📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
-[📄license]: LICENSE.txt
-[📄license-ref]: https://opensource.org/licenses/MIT
-[📄license-img]: https://img.shields.io/badge/License-MIT-259D6C.svg
-[📄license-compat]: https://dev.to/galtzo/how-to-check-license-compatibility-41h0
-[📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&amp;logo=Apache
-[📄ilo-declaration]: https://www.ilo.org/declaration/lang--en/index.htm
-[📄ilo-declaration-img]: https://img.shields.io/badge/ILO_Fundamental_Principles-✓-259D6C.svg?style=flat
-[🚎yard-current]: http://rubydoc.info/gems/oauth2
-[🚎yard-head]: https://oauth2.galtzo.com
-[💎stone_checksums]: https://github.com/galtzo-floss/stone_checksums
-[💎SHA_checksums]: https://gitlab.com/ruby-oauth/oauth2/-/tree/main/checksums
-[💎rlts]: https://github.com/rubocop-lts/rubocop-lts
-[💎rlts-img]: https://img.shields.io/badge/code_style_&amp;_linting-rubocop--lts-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white
-[💎appraisal2]: https://github.com/appraisal-rb/appraisal2
-[💎appraisal2-img]: https://img.shields.io/badge/appraised_by-appraisal2-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white
-[💎d-in-dvcs]: https://railsbling.com/posts/dvcs/put_the_d_in_dvcs/
+Please consider sponsoring me or the project.</p>
+
+<p>To join the community or get help 👇️ Join the Discord.</p>
+
+<p><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a></p>
+
+<p>To say “thanks!” ☝️ Join the Discord or 👇️ send money.</p>
+
+<p><a href="https://opencollective.com/ruby-oauth"><img src="https://img.shields.io/opencollective/all/ruby-oauth?style=for-the-badge" alt="Sponsor ruby-oauth/oauth2 on Open Source Collective"></a> 💌 <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&amp;logo=github" alt="Sponsor me on GitHub Sponsors"></a> 💌 <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&amp;logo=liberapay&amp;color=a51611" alt="Sponsor me on Liberapay"></a> 💌 <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&amp;logo=paypal&amp;color=0A0A0A" alt="Donate on PayPal"></a></p>
+
+<h3 id="please-give-the-project-a-star--">Please give the project a star ⭐ ♥.</h3>
+
+<p>Thanks for RTFM. ☺️</p>
 
 <details>
   <summary>
@@ -1731,13 +1674,12 @@ <h3 id="quick-examples">Quick Examples</h3>
 <a rel="me" alt="Follow me on FLOSS.social" href="https://floss.social/@galtzo"><img src="https://img.shields.io/mastodon/follow/110304921404405715?domain=https://floss.social&amp;style=social&amp;label=Follow%20@galtzo%20on%20Floss.social"></a>
 
 </details>
-</token></realm></realm></details>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.REEK.html b/docs/file.REEK.html
index bc4f2767..fa6fc2fc 100644
--- a/docs/file.REEK.html
+++ b/docs/file.REEK.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.RUBOCOP.html b/docs/file.RUBOCOP.html
index f8f449c1..99b4a4b1 100644
--- a/docs/file.RUBOCOP.html
+++ b/docs/file.RUBOCOP.html
@@ -69,21 +69,20 @@ <h3 id="rubocop-gradual">RuboCop Gradual</h3>
 
 <h3 id="rubocop-lts">RuboCop LTS</h3>
 
-<p>This project uses <code>rubocop-lts</code> to ensure, on a best-effort basis, compatibility with Ruby &gt;= 1.9.2.<br>
+<p>This project uses <code>rubocop-lts</code> to ensure, on a best-effort basis, compatibility with Ruby &gt;= 1.9.2.
 RuboCop rules are meticulously configured by the <code>rubocop-lts</code> family of gems to ensure that a project is compatible with a specific version of Ruby. See: https://rubocop-lts.gitlab.io for more.</p>
 
 <h2 id="checking-rubocop-violations">Checking RuboCop Violations</h2>
 
 <p>To check for RuboCop violations in this project, always use:</p>
 
-<pre class="code language-bash"><code class="language-bash">bundle exec rake rubocop_gradual:check
-</code></pre>
+<p><code>bash
+bundle exec rake rubocop_gradual:check
+</code></p>
 
-<p><strong>Do not use</strong> the standard RuboCop commands like:</p>
-<ul>
-  <li><code>bundle exec rubocop</code></li>
-  <li><code>rubocop</code></li>
-</ul>
+<p><strong>Do not use</strong> the standard RuboCop commands like:
+- <code>bundle exec rubocop</code>
+- <code>rubocop</code></p>
 
 <h2 id="understanding-the-lock-file">Understanding the Lock File</h2>
 
@@ -122,7 +121,7 @@ <h2 id="common-commands">Common Commands</h2>
 <h2 id="workflow">Workflow</h2>
 
 <ol>
-  <li>Before submitting a PR, run <code>bundle exec rake rubocop_gradual:autocorrect</code><br>
+  <li>Before submitting a PR, run <code>bundle exec rake rubocop_gradual:autocorrect</code>
 a. or just the default <code>bundle exec rake</code>, as autocorrection is a pre-requisite of the default task.</li>
   <li>If there are new violations, either:
     <ul>
@@ -150,7 +149,7 @@ <h2 id="never-add-inline-rubocop-disables">Never add inline RuboCop disables</h2
 
 <p>In general, treat the rules as guidance to follow; fix violations rather than ignore them. For example, RSpec conventions in this project expect <code>described_class</code> to be used in specs that target a specific class under test.</p>
 
-<h2 id="benefits-of-rubocop_gradual">Benefits of rubocop_gradual</h2>
+<h2 id="benefits-of-rubocopgradual">Benefits of rubocop_gradual</h2>
 
 <ul>
   <li>Allows incremental adoption of code style rules</li>
@@ -161,9 +160,9 @@ <h2 id="benefits-of-rubocop_gradual">Benefits of rubocop_gradual</h2>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.SECURITY.html b/docs/file.SECURITY.html
index 21f8e0dd..b1a7d6ea 100644
--- a/docs/file.SECURITY.html
+++ b/docs/file.SECURITY.html
@@ -78,24 +78,24 @@ <h2 id="supported-versions">Supported Versions</h2>
 
 <h2 id="security-contact-information">Security contact information</h2>
 
-<p>To report a security vulnerability, please use the<br>
-<a href="https://tidelift.com/security">Tidelift security contact</a>.<br>
+<p>To report a security vulnerability, please use the
+<a href="https://tidelift.com/security">Tidelift security contact</a>.
 Tidelift will coordinate the fix and disclosure.</p>
 
-<p>More detailed explanation of the process is in <a href="file.IRP.html" title="IRP.md">IRP.md</a></p>
+<p>More detailed explanation of the process is in <a href="IRP.md">IRP.md</a></p>
 
 <h2 id="additional-support">Additional Support</h2>
 
-<p>If you are interested in support for versions older than the latest release,<br>
-please consider sponsoring the project / maintainer @ https://liberapay.com/pboling/donate,<br>
-or find other sponsorship links in the <a href="index.html" title="README">README</a>.</p>
+<p>If you are interested in support for versions older than the latest release,
+please consider sponsoring the project / maintainer @ https://liberapay.com/pboling/donate,
+or find other sponsorship links in the <a href="README.md">README</a>.</p>
 
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.THREAT_MODEL.html b/docs/file.THREAT_MODEL.html
index eabbf1c6..d9568287 100644
--- a/docs/file.THREAT_MODEL.html
+++ b/docs/file.THREAT_MODEL.html
@@ -59,10 +59,10 @@
 
       <div id="content"><div id='filecontents'><h1 id="threat-model-outline-for-oauth2-ruby-gem">Threat Model Outline for oauth2 Ruby Gem</h1>
 
-<h2 id="1-overview">1. Overview</h2>
+<h2 id="overview">1. Overview</h2>
 <p>This document outlines the threat model for the <code>oauth2</code> Ruby gem, which implements OAuth 2.0, 2.1, and OIDC Core protocols. The gem is used to facilitate secure authorization and authentication in Ruby applications.</p>
 
-<h2 id="2-assets-to-protect">2. Assets to Protect</h2>
+<h2 id="assets-to-protect">2. Assets to Protect</h2>
 <ul>
   <li>OAuth access tokens, refresh tokens, and ID tokens</li>
   <li>User credentials (if handled)</li>
@@ -71,7 +71,7 @@ <h2 id="2-assets-to-protect">2. Assets to Protect</h2>
   <li>Private keys and certificates (for signing/verifying tokens)</li>
 </ul>
 
-<h2 id="3-potential-threat-actors">3. Potential Threat Actors</h2>
+<h2 id="potential-threat-actors">3. Potential Threat Actors</h2>
 <ul>
   <li>External attackers (internet-based)</li>
   <li>Malicious OAuth clients or resource servers</li>
@@ -79,7 +79,7 @@ <h2 id="3-potential-threat-actors">3. Potential Threat Actors</h2>
   <li>Compromised dependencies</li>
 </ul>
 
-<h2 id="4-attack-surfaces">4. Attack Surfaces</h2>
+<h2 id="attack-surfaces">4. Attack Surfaces</h2>
 <ul>
   <li>OAuth endpoints (authorization, token, revocation, introspection)</li>
   <li>HTTP request/response handling</li>
@@ -88,9 +88,9 @@ <h2 id="4-attack-surfaces">4. Attack Surfaces</h2>
   <li>Dependency supply chain</li>
 </ul>
 
-<h2 id="5-threats-and-mitigations">5. Threats and Mitigations</h2>
+<h2 id="threats-and-mitigations">5. Threats and Mitigations</h2>
 
-<h3 id="51-token-leakage">5.1 Token Leakage</h3>
+<h3 id="token-leakage">5.1 Token Leakage</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Tokens exposed via logs, URLs, or insecure storage</li>
@@ -104,7 +104,7 @@ <h3 id="51-token-leakage">5.1 Token Leakage</h3>
   </li>
 </ul>
 
-<h3 id="52-token-replay-and-forgery">5.2 Token Replay and Forgery</h3>
+<h3 id="token-replay-and-forgery">5.2 Token Replay and Forgery</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Attackers reuse or forge tokens</li>
@@ -118,7 +118,7 @@ <h3 id="52-token-replay-and-forgery">5.2 Token Replay and Forgery</h3>
   </li>
 </ul>
 
-<h3 id="53-insecure-communication">5.3 Insecure Communication</h3>
+<h3 id="insecure-communication">5.3 Insecure Communication</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Data intercepted via MITM attacks</li>
@@ -131,7 +131,7 @@ <h3 id="53-insecure-communication">5.3 Insecure Communication</h3>
   </li>
 </ul>
 
-<h3 id="54-client-secret-exposure">5.4 Client Secret Exposure</h3>
+<h3 id="client-secret-exposure">5.4 Client Secret Exposure</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Client secrets leaked in code or version control</li>
@@ -144,7 +144,7 @@ <h3 id="54-client-secret-exposure">5.4 Client Secret Exposure</h3>
   </li>
 </ul>
 
-<h3 id="55-dependency-vulnerabilities">5.5 Dependency Vulnerabilities</h3>
+<h3 id="dependency-vulnerabilities">5.5 Dependency Vulnerabilities</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Vulnerabilities in third-party libraries</li>
@@ -157,7 +157,7 @@ <h3 id="55-dependency-vulnerabilities">5.5 Dependency Vulnerabilities</h3>
   </li>
 </ul>
 
-<h3 id="56-improper-input-validation">5.6 Improper Input Validation</h3>
+<h3 id="improper-input-validation">5.6 Improper Input Validation</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Injection attacks via untrusted input</li>
@@ -170,7 +170,7 @@ <h3 id="56-improper-input-validation">5.6 Improper Input Validation</h3>
   </li>
 </ul>
 
-<h3 id="57-insufficient-logging-and-monitoring">5.7 Insufficient Logging and Monitoring</h3>
+<h3 id="insufficient-logging-and-monitoring">5.7 Insufficient Logging and Monitoring</h3>
 <ul>
   <li>
 <strong>Threat:</strong> Attacks go undetected</li>
@@ -183,19 +183,19 @@ <h3 id="57-insufficient-logging-and-monitoring">5.7 Insufficient Logging and Mon
   </li>
 </ul>
 
-<h2 id="6-assumptions">6. Assumptions</h2>
+<h2 id="assumptions">6. Assumptions</h2>
 <ul>
   <li>The gem is used in a secure environment with up-to-date Ruby and dependencies</li>
   <li>End-users are responsible for secure configuration and deployment</li>
 </ul>
 
-<h2 id="7-out-of-scope">7. Out of Scope</h2>
+<h2 id="out-of-scope">7. Out of Scope</h2>
 <ul>
   <li>Security of external OAuth providers</li>
   <li>Application-level business logic</li>
 </ul>
 
-<h2 id="8-references">8. References</h2>
+<h2 id="references">8. References</h2>
 <ul>
   <li><a href="https://tools.ietf.org/html/rfc6819">OAuth 2.0 Threat Model and Security Considerations (RFC 6819)</a></li>
   <li><a href="https://owasp.org/www-project-top-ten/">OWASP Top Ten</a></li>
@@ -206,9 +206,9 @@ <h2 id="8-references">8. References</h2>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.access_token.html b/docs/file.access_token.html
index e6fc7b16..1300c2b1 100644
--- a/docs/file.access_token.html
+++ b/docs/file.access_token.html
@@ -57,9 +57,9 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  class AccessToken<br>
-    def self.from_hash: (OAuth2::Client, Hash[untyped, untyped]) -&gt; OAuth2::AccessToken<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  class AccessToken
+    def self.from_hash: (OAuth2::Client, Hash[untyped, untyped]) -&gt; OAuth2::AccessToken
     def self.from_kvform: (OAuth2::Client, String) -&gt; OAuth2::AccessToken</p>
 
 <pre class="code ruby"><code class="ruby">def initialize: (OAuth2::Client, String, ?Hash[Symbol, untyped]) -&gt; void
@@ -84,9 +84,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.authenticator.html b/docs/file.authenticator.html
index 24436d9e..630200ca 100644
--- a/docs/file.authenticator.html
+++ b/docs/file.authenticator.html
@@ -57,8 +57,8 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  class Authenticator<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  class Authenticator
     include OAuth2::FilteredAttributes</p>
 
 <pre class="code ruby"><code class="ruby">attr_reader mode: (Symbol | String)
@@ -81,9 +81,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.client.html b/docs/file.client.html
index c9691758..a21933aa 100644
--- a/docs/file.client.html
+++ b/docs/file.client.html
@@ -57,9 +57,9 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  class Client<br>
-    RESERVED_REQ_KEYS: Array[String]<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  class Client
+    RESERVED_REQ_KEYS: Array[String]
     RESERVED_PARAM_KEYS: Array[String]</p>
 
 <pre class="code ruby"><code class="ruby">include OAuth2::FilteredAttributes
@@ -111,9 +111,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.error.html b/docs/file.error.html
index 0934c7fd..d6e43057 100644
--- a/docs/file.error.html
+++ b/docs/file.error.html
@@ -57,20 +57,20 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  class Error &lt; StandardError<br>
-    def initialize: (OAuth2::Response) -&gt; void<br>
-    def code: () -&gt; (String | Integer | nil)<br>
-    def description: () -&gt; (String | nil)<br>
-    def response: () -&gt; OAuth2::Response<br>
-  end<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  class Error &lt; StandardError
+    def initialize: (OAuth2::Response) -&gt; void
+    def code: () -&gt; (String | Integer | nil)
+    def description: () -&gt; (String | nil)
+    def response: () -&gt; OAuth2::Response
+  end
 end</p>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.filtered_attributes.html b/docs/file.filtered_attributes.html
index 3b36819a..95f557bb 100644
--- a/docs/file.filtered_attributes.html
+++ b/docs/file.filtered_attributes.html
@@ -57,18 +57,18 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  module FilteredAttributes<br>
-    def self.included: (untyped) -&gt; untyped<br>
-    def filtered_attributes: (*String) -&gt; void<br>
-  end<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  module FilteredAttributes
+    def self.included: (untyped) -&gt; untyped
+    def filtered_attributes: (*String) -&gt; void
+  end
 end</p>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.10.gem.html b/docs/file.oauth2-2.0.10.gem.html
index b00e56e9..aaedb848 100644
--- a/docs/file.oauth2-2.0.10.gem.html
+++ b/docs/file.oauth2-2.0.10.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.11.gem.html b/docs/file.oauth2-2.0.11.gem.html
index 11369457..299ada70 100644
--- a/docs/file.oauth2-2.0.11.gem.html
+++ b/docs/file.oauth2-2.0.11.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.12.gem.html b/docs/file.oauth2-2.0.12.gem.html
index c691479c..f5efd44b 100644
--- a/docs/file.oauth2-2.0.12.gem.html
+++ b/docs/file.oauth2-2.0.12.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.13.gem.html b/docs/file.oauth2-2.0.13.gem.html
index 6119b737..72e8abb0 100644
--- a/docs/file.oauth2-2.0.13.gem.html
+++ b/docs/file.oauth2-2.0.13.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.14.gem.html b/docs/file.oauth2-2.0.14.gem.html
index 39830f8f..ee25b93f 100644
--- a/docs/file.oauth2-2.0.14.gem.html
+++ b/docs/file.oauth2-2.0.14.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.15.gem.html b/docs/file.oauth2-2.0.15.gem.html
index af525d3c..c4d115e1 100644
--- a/docs/file.oauth2-2.0.15.gem.html
+++ b/docs/file.oauth2-2.0.15.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.16.gem.html b/docs/file.oauth2-2.0.16.gem.html
index 70c1903d..7abd2400 100644
--- a/docs/file.oauth2-2.0.16.gem.html
+++ b/docs/file.oauth2-2.0.16.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2-2.0.17.gem.html b/docs/file.oauth2-2.0.17.gem.html
index 555bded1..668d7dbd 100644
--- a/docs/file.oauth2-2.0.17.gem.html
+++ b/docs/file.oauth2-2.0.17.gem.html
@@ -61,9 +61,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.oauth2.html b/docs/file.oauth2.html
index ca8fc1ff..af26ebe4 100644
--- a/docs/file.oauth2.html
+++ b/docs/file.oauth2.html
@@ -57,21 +57,21 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
   OAUTH_DEBUG: bool</p>
 
-<p>DEFAULT_CONFIG: untyped<br>
+<p>DEFAULT_CONFIG: untyped
   @config: untyped</p>
 
-<p>def self.config: () -&gt; untyped<br>
-  def self.configure: () { (untyped) -&gt; void } -&gt; void<br>
+<p>def self.config: () -&gt; untyped
+  def self.configure: () { (untyped) -&gt; void } -&gt; void
 end</p>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.response.html b/docs/file.response.html
index 2966fd2c..f9edaafd 100644
--- a/docs/file.response.html
+++ b/docs/file.response.html
@@ -57,8 +57,8 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  class Response<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  class Response
     DEFAULT_OPTIONS: Hash[Symbol, untyped]</p>
 
 <pre class="code ruby"><code class="ruby">def self.register_parser: (Symbol key, (Array[String] | String) mime_types) { (String) -&gt; untyped } -&gt; void
@@ -77,9 +77,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.strategy.html b/docs/file.strategy.html
index 94941ce1..e1f679f3 100644
--- a/docs/file.strategy.html
+++ b/docs/file.strategy.html
@@ -57,10 +57,10 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  module Strategy<br>
-    class Base<br>
-      def initialize: (OAuth2::Client) -&gt; void<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  module Strategy
+    class Base
+      def initialize: (OAuth2::Client) -&gt; void
     end</p>
 
 <pre class="code ruby"><code class="ruby">class AuthCode &lt; Base
@@ -93,9 +93,9 @@
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file.version.html b/docs/file.version.html
index 3a21b7b8..db7a1599 100644
--- a/docs/file.version.html
+++ b/docs/file.version.html
@@ -57,17 +57,17 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p>module OAuth2<br>
-  module Version<br>
-    VERSION: String<br>
-  end<br>
+      <div id="content"><div id='filecontents'><p>module OAuth2
+  module Version
+    VERSION: String
+  end
 end</p>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 19:50:09 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/file_list.html b/docs/file_list.html
index 883a283c..4fec7a08 100644
--- a/docs/file_list.html
+++ b/docs/file_list.html
@@ -102,141 +102,6 @@ <h1 id="full_list_header">File List</h1>
   </li>
   
 
-  <li id="object_CITATION" class="even">
-    <div class="item"><span class="object_link"><a href="file.CITATION.html" title="CITATION">CITATION</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.10.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.10.gem.html" title="oauth2-2.0.10.gem">oauth2-2.0.10.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.11.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.11.gem.html" title="oauth2-2.0.11.gem">oauth2-2.0.11.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.12.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.12.gem.html" title="oauth2-2.0.12.gem">oauth2-2.0.12.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.13.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.13.gem.html" title="oauth2-2.0.13.gem">oauth2-2.0.13.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.14.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.14.gem.html" title="oauth2-2.0.14.gem">oauth2-2.0.14.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.15.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.15.gem.html" title="oauth2-2.0.15.gem">oauth2-2.0.15.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.16.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.16.gem.html" title="oauth2-2.0.16.gem">oauth2-2.0.16.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.17.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.17.gem.html" title="oauth2-2.0.17.gem">oauth2-2.0.17.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.10.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.10.gem.html" title="oauth2-2.0.10.gem">oauth2-2.0.10.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.11.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.11.gem.html" title="oauth2-2.0.11.gem">oauth2-2.0.11.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.12.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.12.gem.html" title="oauth2-2.0.12.gem">oauth2-2.0.12.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.13.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.13.gem.html" title="oauth2-2.0.13.gem">oauth2-2.0.13.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.14.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.14.gem.html" title="oauth2-2.0.14.gem">oauth2-2.0.14.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.15.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.15.gem.html" title="oauth2-2.0.15.gem">oauth2-2.0.15.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.16.gem" class="odd">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.16.gem.html" title="oauth2-2.0.16.gem">oauth2-2.0.16.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2-2.0.17.gem" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2-2.0.17.gem.html" title="oauth2-2.0.17.gem">oauth2-2.0.17.gem</a></span></div>
-  </li>
-  
-
-  <li id="object_REEK" class="odd">
-    <div class="item"><span class="object_link"><a href="file.REEK.html" title="REEK">REEK</a></span></div>
-  </li>
-  
-
-  <li id="object_access_token" class="even">
-    <div class="item"><span class="object_link"><a href="file.access_token.html" title="access_token">access_token</a></span></div>
-  </li>
-  
-
-  <li id="object_authenticator" class="odd">
-    <div class="item"><span class="object_link"><a href="file.authenticator.html" title="authenticator">authenticator</a></span></div>
-  </li>
-  
-
-  <li id="object_client" class="even">
-    <div class="item"><span class="object_link"><a href="file.client.html" title="client">client</a></span></div>
-  </li>
-  
-
-  <li id="object_error" class="odd">
-    <div class="item"><span class="object_link"><a href="file.error.html" title="error">error</a></span></div>
-  </li>
-  
-
-  <li id="object_filtered_attributes" class="even">
-    <div class="item"><span class="object_link"><a href="file.filtered_attributes.html" title="filtered_attributes">filtered_attributes</a></span></div>
-  </li>
-  
-
-  <li id="object_response" class="odd">
-    <div class="item"><span class="object_link"><a href="file.response.html" title="response">response</a></span></div>
-  </li>
-  
-
-  <li id="object_strategy" class="even">
-    <div class="item"><span class="object_link"><a href="file.strategy.html" title="strategy">strategy</a></span></div>
-  </li>
-  
-
-  <li id="object_version" class="odd">
-    <div class="item"><span class="object_link"><a href="file.version.html" title="version">version</a></span></div>
-  </li>
-  
-
-  <li id="object_oauth2" class="even">
-    <div class="item"><span class="object_link"><a href="file.oauth2.html" title="oauth2">oauth2</a></span></div>
-  </li>
-  
-
 
       </ul>
     </div>
diff --git a/docs/index.html b/docs/index.html
index aa7dfaf6..95578274 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -57,13 +57,53 @@
         <div class="clear"></div>
       </div>
 
-      <div id="content"><div id='filecontents'><p><a href="https://discord.gg/3qme4XHNKN"><img src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg" alt="Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0"></a> <a href="https://www.ruby-lang.org/"><img src="https://logos.galtzo.com/assets/images/ruby-lang/avatar-192px.svg" alt="ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://logos.galtzo.com/assets/images/oauth/oauth2/avatar-192px.svg" alt="oauth2 Logo by Chris Messina, CC BY-SA 3.0"></a></p>
-
-<h1 id="-oauth-20-authorization-framework">🔐 OAuth 2.0 Authorization Framework</h1>
+      <div id="content"><div id='filecontents'><table>
+  <thead>
+    <tr>
+      <th>📍 NOTE</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>RubyGems (the <a href="https://github.com/rubygems/">GitHub org</a>, not the website) <a href="https://joel.drapper.me/p/ruby-central-security-measures/">suffered</a> a <a href="https://pup-e.com/blog/goodbye-rubygems/">hostile takeover</a> in September 2025.</td>
+    </tr>
+    <tr>
+      <td>Ultimately <a href="https://www.reddit.com/r/ruby/s/gOk42POCaV">4 maintainers</a> were <a href="https://bsky.app/profile/martinemde.com/post/3m3occezxxs2q">hard removed</a> and a reason has been given for only 1 of those, while 2 others resigned in protest.</td>
+    </tr>
+    <tr>
+      <td>It is a <a href="https://joel.drapper.me/p/ruby-central-takeover/">complicated story</a> which is difficult to <a href="https://joel.drapper.me/p/ruby-central-fact-check/">parse quickly</a>.</td>
+    </tr>
+    <tr>
+      <td>I’m adding notes like this to gems because I <a href="https://joel.drapper.me/p/ruby-central/">don’t condone theft</a> of repositories or gems from their rightful owners.</td>
+    </tr>
+    <tr>
+      <td>If a similar theft happened with my repos/gems, I’d hope some would stand up for me.</td>
+    </tr>
+    <tr>
+      <td>Disenfranchised former-maintainers have started <a href="https://gem.coop">gem.coop</a>.</td>
+    </tr>
+    <tr>
+      <td>Once available I will publish there exclusively; unless RubyCentral makes amends with the community.</td>
+    </tr>
+    <tr>
+      <td>The <a href="https://youtu.be/_H4qbtC5qzU?si=BvuBU90R2wAqD2E6">“Technology for Humans: Joel Draper”</a> podcast episode by <a href="https://reinteractive.com/ruby-on-rails">reinteractive</a> is the most cogent summary I’m aware of.</td>
+    </tr>
+    <tr>
+      <td>See <a href="https://github.com/gem-coop/gem.coop/issues/12">here</a>, <a href="https://gem.coop">here</a> and <a href="https://martinemde.com/2025/10/05/announcing-gem-coop.html">here</a> for more info on what comes next.</td>
+    </tr>
+    <tr>
+      <td>What I’m doing: A (WIP) proposal for <a href="https://github.com/galtzo-floss/bundle-namespace">bundler/gem scopes</a>, and a (WIP) proposal for a federated <a href="https://github.com/galtzo-floss/gem-server">gem server</a>.</td>
+    </tr>
+  </tbody>
+</table>
+
+<p><a href="https://discord.gg/3qme4XHNKN"><img src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-192px.svg" alt="Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0"></a> <a href="https://www.ruby-lang.org/"><img src="https://logos.galtzo.com/assets/images/ruby-lang/avatar-192px.svg" alt="ruby-lang Logo, Yukihiro Matsumoto, Ruby Visual Identity Team, CC BY-SA 2.5"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://logos.galtzo.com/assets/images/oauth/oauth2/avatar-192px.svg" alt="oauth2 Logo by Chris Messina, CC BY-SA 3.0"></a></p>
+
+<h1 id="oauth-20-authorization-framework">🔐 OAuth 2.0 Authorization Framework</h1>
 
 <p>⭐️ including OAuth 2.1 draft spec &amp; OpenID Connect (OIDC)</p>
 
-<p>[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![Open Source Helpers][👽oss-helpi]][👽oss-help] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]</p>
+<p><a href="https://bestgems.org/gems/oauth2"><img src="https://img.shields.io/gem/v/oauth2.svg" alt="Version"></a> <a href="http://github.com/ruby-oauth/oauth2/releases"><img src="https://img.shields.io/github/tag/ruby-oauth/oauth2.svg" alt="GitHub tag (latest SemVer)"></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-259D6C.svg" alt="License: MIT"></a> <a href="https://bestgems.org/gems/oauth2"><img src="https://img.shields.io/gem/rd/oauth2.svg" alt="Downloads Rank"></a> <a href="https://www.codetriage.com/ruby-oauth/oauth2"><img src="https://www.codetriage.com/ruby-oauth/oauth2/badges/users.svg" alt="Open Source Helpers"></a> <a href="https://codecov.io/gh/ruby-oauth/oauth2"><img src="https://codecov.io/gh/ruby-oauth/oauth2/graph/badge.svg" alt="CodeCov Test Coverage"></a> <a href="https://coveralls.io/github/ruby-oauth/oauth2?branch=main"><img src="https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main" alt="Coveralls Test Coverage"></a> <a href="https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating"><img src="https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg" alt="QLTY Test Coverage"></a> <a href="https://qlty.sh/gh/ruby-oauth/projects/oauth2"><img src="https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg" alt="QLTY Maintainability"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml/badge.svg" alt="CI Heads"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml/badge.svg" alt="CI Runtime Dependencies @ HEAD"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml/badge.svg" alt="CI Current"></a> [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml/badge.svg" alt="CI JRuby"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml/badge.svg" alt="Deps Locked"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml/badge.svg" alt="Deps Unlocked"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml/badge.svg" alt="CI Supported"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml/badge.svg" alt="CI Legacy"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml/badge.svg" alt="CI Unsupported"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml/badge.svg" alt="CI Ancient"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml/badge.svg" alt="CI Test Coverage"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml/badge.svg" alt="CI Style"></a> <a href="https://github.com/ruby-oauth/oauth2/security/code-scanning"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/codeql-analysis.yml/badge.svg" alt="CodeQL"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml"><img src="https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml/badge.svg" alt="Apache SkyWalking Eyes License Compatibility Check"></a></p>
 
 <p><code>if ci_badges.map(&amp;:color).detect { it != "green"}</code> ☝️ <a href="https://discord.gg/3qme4XHNKN">let me know</a>, as I may have missed the <a href="https://discord.gg/3qme4XHNKN">discord notification</a>.</p>
 
@@ -71,13 +111,13 @@ <h1 id="-oauth-20-authorization-framework">🔐 OAuth 2.0 Authorization Framewor
 
 <p><code>if ci_badges.map(&amp;:color).all? { it == "green"}</code> 👇️ send money so I can do more of this. FLOSS maintenance is now my full-time job.</p>
 
-<p>[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]</p>
+<p><a href="https://opencollective.com/ruby-oauth#backer"><img src="https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat" alt="OpenCollective Backers"></a> <a href="https://opencollective.com/ruby-oauth#sponsor"><img src="https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat" alt="OpenCollective Sponsors"></a> <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github" alt="Sponsor Me on Github"></a> <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat" alt="Liberapay Goal Progress"></a> <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal" alt="Donate on PayPal"></a> <a href="https://www.buymeacoffee.com/pboling"><img src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat" alt="Buy me a coffee"></a> <a href="https://polar.sh/pboling"><img src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat" alt="Donate on Polar"></a> <a href="https://ko-fi.com/O5O86SNP4"><img src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat" alt="Donate at ko-fi.com"></a></p>
 
-<h2 id="-synopsis">🌻 Synopsis</h2>
+<h2 id="synopsis">🌻 Synopsis</h2>
 
-<p>OAuth 2.0 is the industry-standard protocol for authorization.<br>
-OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,<br>
-    desktop applications, mobile phones, and living room devices.<br>
+<p>OAuth 2.0 is the industry-standard protocol for authorization.
+OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,
+    desktop applications, mobile phones, and living room devices.
 This is a RubyGem for implementing OAuth 2.0 clients (not servers) in Ruby applications.</p>
 
 <h3 id="quick-examples">Quick Examples</h3>
@@ -85,7 +125,7 @@ <h3 id="quick-examples">Quick Examples</h3>
 <details>
   <summary>Convert the following `curl` command into a token request using this gem...</summary>
 
-```shell
+  <p><code>shell
 curl --request POST \
   --url 'https://login.microsoftonline.com/REDMOND_REDACTED/oauth2/token' \
   --header 'content-type: application/x-www-form-urlencoded' \
@@ -93,11 +133,11 @@ <h3 id="quick-examples">Quick Examples</h3>
   --data client_id=REDMOND_CLIENT_ID \
   --data client_secret=REDMOND_CLIENT_SECRET \
   --data resource=REDMOND_RESOURCE_UUID
-```
+</code></p>
 
-NOTE: In the ruby version below, certain params are passed to the `get_token` call, instead of the client creation.
+  <p>NOTE: In the ruby version below, certain params are passed to the <code>get_token</code> call, instead of the client creation.</p>
 
-```ruby
+  <p><code>ruby
 OAuth2::Client.new(
   "REDMOND_CLIENT_ID", # client_id
   "REDMOND_CLIENT_SECRET", # client_secret
@@ -107,469 +147,485 @@ <h3 id="quick-examples">Quick Examples</h3>
 ). # The base path for token_url when it is relative
   client_credentials. # There are many other types to choose from!
   get_token(resource: "REDMOND_RESOURCE_UUID")
-```
+</code></p>
 
-NOTE: `header` - The content type specified in the `curl` is already the default!
+  <p>NOTE: <code>header</code> - The content type specified in the <code>curl</code> is already the default!</p>
 
 </details>
 
-<details>
+<p>&lt;details markdown=”1&gt;</p>
 <summary>Complete E2E single file script against mock-oauth2-server</summary>
 
-- E2E example uses [navikt/mock-oauth2-server](https://github.com/navikt/mock-oauth2-server), which was added in v2.0.11
-- E2E example does not ship with the released gem, so clone the source to play with it.
+<ul>
+  <li>E2E example uses <a href="https://github.com/navikt/mock-oauth2-server">navikt/mock-oauth2-server</a>, which was added in v2.0.11</li>
+  <li>E2E example does not ship with the released gem, so clone the source to play with it.</li>
+</ul>
 
-```console
+<p><code>console
 docker compose -f docker-compose-ssl.yml up -d --wait
 ruby examples/e2e.rb
 # If your machine is slow or Docker pulls are cold, increase the wait:
 E2E_WAIT_TIMEOUT=120 ruby examples/e2e.rb
 # The mock server serves HTTP on 8080; the example points to http://localhost:8080 by default.
-```
+</code></p>
 
-The output should be something like this:
+<p>The output should be something like this:</p>
 
-```console
+<p><code>console
 ➜  ruby examples/e2e.rb
 Access token (truncated): eyJraWQiOiJkZWZhdWx0...
 userinfo status: 200
-userinfo body: =&gt; "demo-sub", "aud" =&gt; ["demo-aud"], "nbf" =&gt; 1757816758000, "iss" =&gt; "http://localhost:8080/default", "exp" =&gt; 1757820358000, "iat" =&gt; 1757816758000, "jti" =&gt; "d63b97a7-ebe5-4dea-93e6-d542caba6104"
+userinfo body: {"sub" =&gt; "demo-sub", "aud" =&gt; ["demo-aud"], "nbf" =&gt; 1757816758000, "iss" =&gt; "http://localhost:8080/default", "exp" =&gt; 1757820358000, "iat" =&gt; 1757816758000, "jti" =&gt; "d63b97a7-ebe5-4dea-93e6-d542caba6104"}
 E2E complete
-```
+</code></p>
 
-Make sure to shut down the mock server when you are done:
+<p>Make sure to shut down the mock server when you are done:</p>
 
-```console
+<p><code>console
 docker compose -f docker-compose-ssl.yml down
-```
-
-Troubleshooting: validate connectivity to the mock server
-
-- Check container status and port mapping:
-    - `docker compose -f docker-compose-ssl.yml ps`
-- From the host, try the discovery URL directly (this is what the example uses by default):
-    - `curl -v http://localhost:8080/default/.well-known/openid-configuration`
-    - If that fails immediately, also try: `curl -v --connect-timeout 2 http://127.0.0.1:8080/default/.well-known/openid-configuration`
-- From inside the container (to distinguish container vs. host networking):
-    - `docker exec -it oauth2-mock-oauth2-server-1 curl -v http://127.0.0.1:8080/default/.well-known/openid-configuration`
-- Simple TCP probe from the host:
-    - `nc -vz localhost 8080  # or: ruby -rsocket -e 'TCPSocket.new("localhost",8080).close; puts "tcp ok"'`
-- Inspect which host port 8080 is bound to (should be 8080):
-    - `docker inspect -f '(index (index .NetworkSettings.Ports "8080/tcp") 0).HostPort }' oauth2-mock-oauth2-server-1`
-- Look at server logs for readiness/errors:
-    - `docker logs -n 200 oauth2-mock-oauth2-server-1`
-- On Linux, ensure nothing else is bound to 8080 and that firewall/SELinux aren’t blocking:
-    - `ss -ltnp | grep :8080`
-
-Notes
-- Discovery URL pattern is: `http://localhost:8080/<realm>/.well-known/openid-configuration`, where `<realm>` defaults to `default`.
-- You can change these with env vars when running the example:
-    - `E2E_ISSUER_BASE` (default: http://localhost:8080)
-    - `E2E_REALM` (default: default)
-
-&lt;/details&gt;
-
-If it seems like you are in the wrong place, you might try one of these:
-
-* [OAuth 2.0 Spec][oauth2-spec]
-* [doorkeeper gem][doorkeeper-gem] for OAuth 2.0 server/provider implementation.
-* [oauth sibling gem][sibling-gem] for OAuth 1.0a implementations in Ruby.
-
-[oauth2-spec]: https://oauth.net/2/
-[sibling-gem]: https://gitlab.com/ruby-oauth/oauth
-[doorkeeper-gem]: https://github.com/doorkeeper-gem/doorkeeper
-
-## 💡 Info you can shake a stick at
-
-| Tokens to Remember      | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace]                                                                                                                                                                                                                                                                                                                                                                               |
-|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Works with JRuby        | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]                                                                                                                                                                                                               |
-| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf]                                                                                                                                                                                                                                                                 |
-| Works with MRI Ruby 3   | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]                                                                                                                                                                                              |
-| Works with MRI Ruby 2   | ![Ruby 2.2 Compat][💎ruby-2.2i] <br> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf]                                                                                                                                                                                                   |
-| Support &amp; Community     | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]                                                                                                                                            |
-| Source                  | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc]                                                                                                                                                                                                                                                              |
-| Documentation           | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki]                                                                                                                                                                                               |
-| Compliance              | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Incident Response Plan][🔐irp-img]][🔐irp] [![Security Policy][🔐security-img]][🔐security] [![Threat Model][🔐threat-model-img]][🔐threat-model]  [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
-| Style                   | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2]                                                                                                                                                                                                                       |
-| Maintainer 🎖️          | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto]                                                                                                                                                           |
-| `...` 💖                | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub]  [🛖][💖🛖hut] [🧪][💖🧪lab]                                                                                                                                                                        |
-
-### Compatibility
-
-* Operating Systems: Linux, macOS, Windows
-* MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
-    * NOTE: This gem may still _install_ and _run_ on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* JRuby @ v9.4, v10.0, HEAD
-    * NOTE: This gem may still _install_ and _run_ on JRuby v9.2 and v9.3, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* TruffleRuby @ v23.1, v24.1, HEAD
-    * NOTE: This gem may still _install_ and _run_ on Truffleruby v22.3 and v23.0, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
-* gem `faraday` @ v0, v1, v2, HEAD ⏩️ [lostisland/faraday](https://github.com/lostisland/faraday)
-* gem `jwt` @ v1, v2, v3, HEAD ⏩️ [jwt/ruby-jwt](https://github.com/jwt/ruby-jwt)
-* gem `logger` @ v1.2, v1.5, v1.7, HEAD ⏩️ [ruby/logger](https://github.com/ruby/logger)
-* gem `multi_xml` @ v0.5, v0.6, v0.7, HEAD ⏩️ [sferik/multi_xml](https://github.com/sferik/multi_xml)
-* gem `rack` @ v1.2, v1.6, v2, v3, HEAD ⏩️ [rack/rack](https://github.com/rack/rack)
-* gem `snaky_hash` @ v2, HEAD ⏩️ [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash)
-* gem `version_gem` @ v1, HEAD ⏩️ [ruby-oauth/version_gem](https://gitlab.com/ruby-oauth/version_gem)
-
-The last two were extracted from this gem. They are part of the `ruby-oauth` org,
-and are developed in tight collaboration with this gem.
-
-Also, where reasonable, tested against the runtime dependencies of those dependencies:
-
-* gem `hashie` @ v0, v1, v2, v3, v4, v5, HEAD ⏩️ [hashie/hashie](https://github.com/hashie/hashie)
-
-[GHA-continue-on-error-ui]: https://github.com/actions/runner/issues/2347#issuecomment-2653479732
-[GHA-allow-failure]: https://github.com/orgs/community/discussions/15452
-
-#### Upgrading Runtime Gem Dependencies
-
-This project sits underneath a large portion of the authorization systems on the internet.
-According to GitHub's project tracking, which I believe only reports on public projects,
-[100,000+ projects](https://github.com/ruby-oauth/oauth2/network/dependents), and
-[500+ packages](https://github.com/ruby-oauth/oauth2/network/dependents?dependent_type=PACKAGE) depend on this project.
-
-That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
-
-As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the
-leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
-
-What does that mean specifically for the runtime dependencies?
-
-We have 100% test coverage of lines and branches, and this test suite runs across a very large matrix.
-It wouldn't be possible without appraisal2.
-
-| 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚             |
-|------------------------------------------------|--------------------------------------------------------|
-| 👟 Check it out!                               | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
-
-#### You should upgrade this gem with confidence\*.
-
-- This gem follows a _strict &amp; correct_ (according to the maintainer of SemVer; [more info][sv-pub-api]) interpretation of SemVer.
-    - Dropping support for **any** of the runtime dependency versions above will be a major version bump.
-    - If you aren't on one of the minor versions above, make getting there a priority.
-- You should upgrade the dependencies of this gem with confidence\*.
-- Please do upgrade, and then, when it goes smooth as butter [please sponsor me][🖇sponsor].  Thanks!
-
-[sv-pub-api]: #-versioning
-
-\* MIT license; The only guarantees I make are for [enterprise support](#enterprise-support).
+</code></p>
 
-<details>
-  <summary>Standard Library Dependencies</summary>
-
-The various versions of each are tested via the Ruby test matrix, along with whatever Ruby includes them.
-
-* base64
-* cgi
-* json
-* time
-* logger (removed from stdlib in Ruby 3.5 so added as runtime dependency in v2.0.10)
+<p>Troubleshooting: validate connectivity to the mock server</p>
 
-If you use a gem version of a core Ruby library, it should work fine!
-
-</details>
+<ul>
+  <li>Check container status and port mapping:
+    <ul>
+      <li><code>docker compose -f docker-compose-ssl.yml ps</code></li>
+    </ul>
+  </li>
+  <li>From the host, try the discovery URL directly (this is what the example uses by default):
+    <ul>
+      <li><code>curl -v http://localhost:8080/default/.well-known/openid-configuration</code></li>
+      <li>If that fails immediately, also try: <code>curl -v --connect-timeout 2 http://127.0.0.1:8080/default/.well-known/openid-configuration</code>
+</li>
+    </ul>
+  </li>
+  <li>From inside the container (to distinguish container vs. host networking):
+    <ul>
+      <li><code>docker exec -it oauth2-mock-oauth2-server-1 curl -v http://127.0.0.1:8080/default/.well-known/openid-configuration</code></li>
+    </ul>
+  </li>
+  <li>Simple TCP probe from the host:
+    <ul>
+      <li><code>nc -vz localhost 8080  # or: ruby -rsocket -e 'TCPSocket.new("localhost",8080).close; puts "tcp ok"'</code></li>
+    </ul>
+  </li>
+  <li>Inspect which host port 8080 is bound to (should be 8080):
+    <ul>
+      <li><code>docker inspect -f '{{ (index (index .NetworkSettings.Ports "8080/tcp") 0).HostPort }}' oauth2-mock-oauth2-server-1</code></li>
+    </ul>
+  </li>
+  <li>Look at server logs for readiness/errors:
+    <ul>
+      <li><code>docker logs -n 200 oauth2-mock-oauth2-server-1</code></li>
+    </ul>
+  </li>
+  <li>On Linux, ensure nothing else is bound to 8080 and that firewall/SELinux aren’t blocking:
+    <ul>
+      <li><code>ss -ltnp | grep :8080</code></li>
+    </ul>
+  </li>
+</ul>
 
-### Federated DVCS
+<p>Notes</p>
 
-<details>
-  <summary>Find this repo on federated forges</summary>
-
-| Federated [DVCS][💎d-in-dvcs] Repository      | Status                                                                | Issues                    | PRs                      | Wiki                      | CI                       | Discussions                  |
-|-----------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
-| 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl]    | The Truth                                                             | [💚][🤝gl-issues]         | [💚][🤝gl-pulls]         | [💚][📜gl-wiki]           | 🐭 Tiny Matrix           | ➖                            |
-| 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb]  | An Ethical Mirror ([Donate][🤝cb-donate])                             | [💚][🤝cb-issues]         | [💚][🤝cb-pulls]         | ➖                         | ⭕️ No Matrix             | ➖                            |
-| 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh]    | Another Mirror                                                        | [💚][🤝gh-issues]         | [💚][🤝gh-pulls]         | [💚][📜gh-wiki]           | 💯 Full Matrix           | [💚][gh-discussions]         |
-| 🤼 [OAuth Ruby Google Group][⛳gg-discussions] | "Active"                                                              | ➖                         | ➖                        | ➖                         | ➖                        | [💚][⛳gg-discussions]        |
-| 🎮️ [Discord Server][✉️discord-invite]        | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
+<ul>
+  <li>Discovery URL pattern is: <code>http://localhost:8080/&lt;realm&gt;/.well-known/openid-configuration</code>, where <code>&lt;realm&gt;</code> defaults to <code>default</code>.</li>
+  <li>You can change these with env vars when running the example:
+    <ul>
+      <li>
+<code>E2E_ISSUER_BASE</code> (default: http://localhost:8080)</li>
+      <li>
+<code>E2E_REALM</code> (default: default)</li>
+    </ul>
+  </li>
+</ul>
 
-</details>
+<p>&lt;/details&gt;</p>
 
-[gh-discussions]: https://github.com/ruby-oauth/oauth2/discussions
+<p>If it seems like you are in the wrong place, you might try one of these:</p>
 
-### Enterprise Support [![Tidelift](https://tidelift.com/badges/package/rubygems/oauth2)](https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme)
+<ul>
+  <li><a href="https://oauth.net/2/">OAuth 2.0 Spec</a></li>
+  <li>
+<a href="https://github.com/doorkeeper-gem/doorkeeper">doorkeeper gem</a> for OAuth 2.0 server/provider implementation.</li>
+  <li>
+<a href="https://gitlab.com/ruby-oauth/oauth">oauth sibling gem</a> for OAuth 1.0a implementations in Ruby.</li>
+</ul>
 
-Available as part of the Tidelift Subscription.
+<h2 id="info-you-can-shake-a-stick-at">💡 Info you can shake a stick at</h2>
+
+<table>
+  <thead>
+    <tr>
+      <th>Tokens to Remember</th>
+      <th>
+<a href="https://bestgems.org/gems/oauth2"><img src="https://img.shields.io/badge/name-oauth2-3C2D2D.svg?style=square&amp;logo=rubygems&amp;logoColor=red" alt="Gem name"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://img.shields.io/badge/namespace-OAuth2-3C2D2D.svg?style=square&amp;logo=ruby&amp;logoColor=white" alt="Gem namespace"></a>
+</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>Works with JRuby</td>
+      <td>
+<img src="https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.1 Compat"> <img src="https://img.shields.io/badge/JRuby-9.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.2 Compat"> <img src="https://img.shields.io/badge/JRuby-9.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.3 Compat"> <br> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml"><img src="https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=red" alt="JRuby 9.4 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://img.shields.io/badge/JRuby-current-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=green" alt="JRuby 10.0 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml"><img src="https://img.shields.io/badge/JRuby-HEAD-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue" alt="JRuby HEAD Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Works with Truffle Ruby</td>
+      <td>
+<img src="https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink" alt="Truffle Ruby 22.3 Compat"> <img src="https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink" alt="Truffle Ruby 23.0 Compat"> <img src="https://img.shields.io/badge/Truffle_Ruby-23.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink" alt="Truffle Ruby 23.1 Compat"> <br> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=green" alt="Truffle Ruby 24.1 Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Works with MRI Ruby 3</td>
+      <td>
+<a href="https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml"><img src="https://img.shields.io/badge/Ruby-3.0-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.0 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://img.shields.io/badge/Ruby-3.1-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.1 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://img.shields.io/badge/Ruby-3.2-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.2 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml"><img src="https://img.shields.io/badge/Ruby-3.3-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 3.3 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml"><img src="https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=green" alt="Ruby 3.4 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml"><img src="https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue" alt="Ruby HEAD Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Works with MRI Ruby 2</td>
+      <td>
+<img src="https://img.shields.io/badge/Ruby-2.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.2 Compat"> <br> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://img.shields.io/badge/Ruby-2.3-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.3 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://img.shields.io/badge/Ruby-2.4-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.4 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml"><img src="https://img.shields.io/badge/Ruby-2.5-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.5 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml"><img src="https://img.shields.io/badge/Ruby-2.6-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.6 Compat"></a> <a href="https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml"><img src="https://img.shields.io/badge/Ruby-2.7-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white" alt="Ruby 2.7 Compat"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Support &amp; Community</td>
+      <td>
+<a href="https://app.daily.dev/squads/rubyfriends"><img src="https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&amp;logo=dailydotdev&amp;logoColor=white" alt="Join Me on Daily.dev's RubyFriends"></a> <a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a> <a href="https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share"><img src="https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&amp;logo=Upwork&amp;logoColor=white" alt="Get help from me on Upwork"></a> <a href="https://www.codementor.io/peterboling?utm_source=github&amp;utm_medium=button&amp;utm_term=peterboling&amp;utm_campaign=github"><img src="https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&amp;logo=CodeMentor&amp;logoColor=white" alt="Get help from me on Codementor"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Source</td>
+      <td>
+<a href="https://gitlab.com/ruby-oauth/oauth2/"><img src="https://img.shields.io/badge/GitLab-FBA326?style=for-the-badge&amp;logo=Gitlab&amp;logoColor=orange" alt="Source on GitLab.com"></a> <a href="https://codeberg.org/ruby-oauth/oauth2"><img src="https://img.shields.io/badge/CodeBerg-4893CC?style=for-the-badge&amp;logo=CodeBerg&amp;logoColor=blue" alt="Source on CodeBerg.org"></a> <a href="https://github.com/ruby-oauth/oauth2"><img src="https://img.shields.io/badge/GitHub-238636?style=for-the-badge&amp;logo=Github&amp;logoColor=green" alt="Source on Github.com"></a> <a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ"><img src="https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&amp;logo=YouTube&amp;logoColor=blue" alt="The best SHA: dQw4w9WgXcQ!"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Documentation</td>
+      <td>
+<a href="http://rubydoc.info/gems/oauth2"><img src="https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white" alt="Current release on RubyDoc.info"></a> <a href="https://oauth2.galtzo.com"><img src="https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white" alt="YARD on Galtzo.com"></a> <a href="http://www.railsbling.com/tags/oauth2"><img src="https://img.shields.io/badge/blog-railsbling-0093D0.svg?style=for-the-badge&amp;logo=rubyonrails&amp;logoColor=orange" alt="Maintainer Blog"></a> <a href="https://gitlab.com/ruby-oauth/oauth2/-/wikis/home"><img src="https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=gitlab&amp;logoColor=white" alt="GitLab Wiki"></a> <a href="https://github.com/ruby-oauth/oauth2/wiki"><img src="https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=github&amp;logoColor=white" alt="GitHub Wiki"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Compliance</td>
+      <td>
+<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-259D6C.svg" alt="License: MIT"></a> <a href="https://dev.to/galtzo/how-to-check-license-compatibility-41h0"><img src="https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&amp;logo=Apache" alt="Compatible with Apache Software Projects: Verified by SkyWalking Eyes"></a> <a href="https://www.ilo.org/declaration/lang--en/index.htm"><img src="https://img.shields.io/badge/ILO_Fundamental_Principles-%E2%9C%93-259D6C.svg?style=flat" alt="📄ilo-declaration-img"></a> <a href="SECURITY.md"><img src="https://img.shields.io/badge/security-policy-259D6C.svg?style=flat" alt="Security Policy"></a> <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg" alt="Contributor Covenant 2.1"></a> <a href="https://semver.org/spec/v2.0.0.html"><img src="https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat" alt="SemVer 2.0.0"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Style</td>
+      <td>
+<a href="https://github.com/rubocop-lts/rubocop-lts"><img src="https://img.shields.io/badge/code_style_&amp;_linting-rubocop--lts-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white" alt="Enforced Code Style Linter"></a> <a href="https://keepachangelog.com/en/1.0.0/"><img src="https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat" alt="Keep-A-Changelog 1.0.0"></a> <a href="https://gitmoji.dev"><img src="https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square" alt="Gitmoji Commits"></a> <a href="https://github.com/appraisal-rb/appraisal2"><img src="https://img.shields.io/badge/appraised_by-appraisal2-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white" alt="Compatibility appraised by: appraisal2"></a>
+</td>
+    </tr>
+    <tr>
+      <td>Maintainer 🎖️</td>
+      <td>
+<a href="http://www.linkedin.com/in/peterboling"><img src="https://img.shields.io/badge/PeterBoling-LinkedIn-0B66C2?style=flat&amp;logo=newjapanprowrestling" alt="Follow Me on LinkedIn"></a> <a href="https://ruby.social/@galtzo"><img src="https://img.shields.io/mastodon/follow/109447111526622197?domain=https://ruby.social&amp;style=flat&amp;logo=mastodon&amp;label=Ruby%20@galtzo" alt="Follow Me on Ruby.Social"></a> <a href="https://bsky.app/profile/galtzo.com"><img src="https://img.shields.io/badge/@galtzo.com-0285FF?style=flat&amp;logo=bluesky&amp;logoColor=white" alt="Follow Me on Bluesky"></a> <a href="http://www.railsbling.com/contact"><img src="https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&amp;logo=rubyonrails&amp;logoColor=red" alt="Contact Maintainer"></a> <a href="https://dev.to/galtzo"><img src="https://img.shields.io/badge/dev.to-0A0A0A?style=flat&amp;logo=devdotto&amp;logoColor=white" alt="My technical writing"></a>
+</td>
+    </tr>
+    <tr>
+      <td>
+<code>...</code> 💖</td>
+      <td>
+<a href="https://wellfound.com/u/peter-boling"><img src="https://img.shields.io/badge/peter--boling-orange?style=flat&amp;logo=wellfound" alt="Find Me on WellFound:"></a> <a href="https://www.crunchbase.com/person/peter-boling"><img src="https://img.shields.io/badge/peter--boling-purple?style=flat&amp;logo=crunchbase" alt="Find Me on CrunchBase"></a> <a href="https://linktr.ee/galtzo"><img src="https://img.shields.io/badge/galtzo-purple?style=flat&amp;logo=linktree" alt="My LinkTree"></a> <a href="https://about.me/peter.boling"><img src="https://img.shields.io/badge/about.me-0A0A0A?style=flat&amp;logo=aboutme&amp;logoColor=white" alt="More About Me"></a> <a href="https://codeberg.org/pboling">🧊</a> <a href="https://github.org/pboling">🐙</a>  <a href="https://sr.ht/~galtzo/">🛖</a> <a href="https://gitlab.com/pboling">🧪</a>
+</td>
+    </tr>
+  </tbody>
+</table>
+
+<h3 id="compatibility">Compatibility</h3>
+
+<p>Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.</p>
+
+<table>
+  <thead>
+    <tr>
+      <th>🚚 <em>Amazing</em> test matrix was brought to you by</th>
+      <th>🔎 appraisal2 🔎 and the color 💚 green 💚</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>👟 Check it out!</td>
+      <td>✨ <a href="https://github.com/appraisal-rb/appraisal2">github.com/appraisal-rb/appraisal2</a> ✨</td>
+    </tr>
+  </tbody>
+</table>
+
+<h3 id="federated-dvcs">Federated DVCS</h3>
 
 <details>
-  <summary>Need enterprise-level guarantees?</summary>
-
-The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
-
-[![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]
-
-- 💡Subscribe for support guarantees covering _all_ your FLOSS dependencies
-- 💡Tidelift is part of [Sonar][🏙️entsup-tidelift-sonar]
-- 💡Tidelift pays maintainers to maintain the software you depend on!<br>📊`@`Pointy Haired Boss: An [enterprise support][🏙️entsup-tidelift] subscription is "[never gonna let you down][🧮kloc]", and *supports* open source maintainers
-
-Alternatively:
-
-- [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
-- [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork]
-- [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor]
+  <summary>Find this repo on federated forges (Coming soon!)</summary>
+
+  <table>
+    <thead>
+      <tr>
+        <th>Federated <a href="https://railsbling.com/posts/dvcs/put_the_d_in_dvcs/">DVCS</a> Repository</th>
+        <th>Status</th>
+        <th>Issues</th>
+        <th>PRs</th>
+        <th>Wiki</th>
+        <th>CI</th>
+        <th>Discussions</th>
+      </tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td>🧪 <a href="https://gitlab.com/ruby-oauth/oauth2/">ruby-oauth/oauth2 on GitLab</a>
+</td>
+        <td>The Truth</td>
+        <td><a href="https://gitlab.com/ruby-oauth/oauth2/-/issues">💚</a></td>
+        <td><a href="https://gitlab.com/ruby-oauth/oauth2/-/merge_requests">💚</a></td>
+        <td><a href="https://gitlab.com/ruby-oauth/oauth2/-/wikis/home">💚</a></td>
+        <td>🐭 Tiny Matrix</td>
+        <td>➖</td>
+      </tr>
+      <tr>
+        <td>🧊 <a href="https://codeberg.org/ruby-oauth/oauth2">ruby-oauth/oauth2 on CodeBerg</a>
+</td>
+        <td>An Ethical Mirror (<a href="https://donate.codeberg.org/">Donate</a>)</td>
+        <td><a href="https://codeberg.org/ruby-oauth/oauth2/issues">💚</a></td>
+        <td><a href="https://codeberg.org/ruby-oauth/oauth2/pulls">💚</a></td>
+        <td>➖</td>
+        <td>⭕️ No Matrix</td>
+        <td>➖</td>
+      </tr>
+      <tr>
+        <td>🐙 <a href="https://github.com/ruby-oauth/oauth2">ruby-oauth/oauth2 on GitHub</a>
+</td>
+        <td>Another Mirror</td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/issues">💚</a></td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/pulls">💚</a></td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/wiki">💚</a></td>
+        <td>💯 Full Matrix</td>
+        <td><a href="https://github.com/ruby-oauth/oauth2/discussions">💚</a></td>
+      </tr>
+      <tr>
+        <td>🎮️ <a href="https://discord.gg/3qme4XHNKN">Discord Server</a>
+</td>
+        <td><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">Let’s</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">talk</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">about</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">this</a></td>
+        <td><a href="https://discord.gg/3qme4XHNKN">library!</a></td>
+      </tr>
+    </tbody>
+  </table>
 
 </details>
 
-## 🚀 Release Documentation
+<h3 id="enterprise-support-tidelifthttpstideliftcombadgespackagerubygemsoauth2httpstideliftcomsubscriptionpkgrubygems-oauth2utmsourcerubygems-oauth2utmmediumreferralutmcampaignreadme">Enterprise Support <a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme"><img src="https://tidelift.com/badges/package/rubygems/oauth2" alt="Tidelift"></a>
+</h3>
 
-### Version 2.0.x
+<p>Available as part of the Tidelift Subscription.</p>
 
 <details>
-  <summary>2.0.x CHANGELOG and README</summary>
-
-| Version | Release Date | CHANGELOG                             | README                          |
-|---------|--------------|---------------------------------------|---------------------------------|
-| 2.0.17  | 2025-09-15   | [v2.0.17 CHANGELOG][2.0.17-changelog] | [v2.0.17 README][2.0.17-readme] |
-| 2.0.16  | 2025-09-14   | [v2.0.16 CHANGELOG][2.0.16-changelog] | [v2.0.16 README][2.0.16-readme] |
-| 2.0.15  | 2025-09-08   | [v2.0.15 CHANGELOG][2.0.15-changelog] | [v2.0.15 README][2.0.15-readme] |
-| 2.0.14  | 2025-08-31   | [v2.0.14 CHANGELOG][2.0.14-changelog] | [v2.0.14 README][2.0.14-readme] |
-| 2.0.13  | 2025-08-30   | [v2.0.13 CHANGELOG][2.0.13-changelog] | [v2.0.13 README][2.0.13-readme] |
-| 2.0.12  | 2025-05-31   | [v2.0.12 CHANGELOG][2.0.12-changelog] | [v2.0.12 README][2.0.12-readme] |
-| 2.0.11  | 2025-05-23   | [v2.0.11 CHANGELOG][2.0.11-changelog] | [v2.0.11 README][2.0.11-readme] |
-| 2.0.10  | 2025-05-17   | [v2.0.10 CHANGELOG][2.0.10-changelog] | [v2.0.10 README][2.0.10-readme] |
-| 2.0.9   | 2022-09-16   | [v2.0.9 CHANGELOG][2.0.9-changelog]   | [v2.0.9 README][2.0.9-readme]   |
-| 2.0.8   | 2022-09-01   | [v2.0.8 CHANGELOG][2.0.8-changelog]   | [v2.0.8 README][2.0.8-readme]   |
-| 2.0.7   | 2022-08-22   | [v2.0.7 CHANGELOG][2.0.7-changelog]   | [v2.0.7 README][2.0.7-readme]   |
-| 2.0.6   | 2022-07-13   | [v2.0.6 CHANGELOG][2.0.6-changelog]   | [v2.0.6 README][2.0.6-readme]   |
-| 2.0.5   | 2022-07-07   | [v2.0.5 CHANGELOG][2.0.5-changelog]   | [v2.0.5 README][2.0.5-readme]   |
-| 2.0.4   | 2022-07-01   | [v2.0.4 CHANGELOG][2.0.4-changelog]   | [v2.0.4 README][2.0.4-readme]   |
-| 2.0.3   | 2022-06-28   | [v2.0.3 CHANGELOG][2.0.3-changelog]   | [v2.0.3 README][2.0.3-readme]   |
-| 2.0.2   | 2022-06-24   | [v2.0.2 CHANGELOG][2.0.2-changelog]   | [v2.0.2 README][2.0.2-readme]   |
-| 2.0.1   | 2022-06-22   | [v2.0.1 CHANGELOG][2.0.1-changelog]   | [v2.0.1 README][2.0.1-readme]   |
-| 2.0.0   | 2022-06-21   | [v2.0.0 CHANGELOG][2.0.0-changelog]   | [v2.0.0 README][2.0.0-readme]   |
-
-</details>
-
-[2.0.17-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2017---2025-09-15
-[2.0.16-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2016---2025-09-14
-[2.0.15-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2015---2025-09-08
-[2.0.14-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2014---2025-08-31
-[2.0.13-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2013---2025-08-30
-[2.0.12-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2012---2025-05-31
-[2.0.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2011---2025-05-23
-[2.0.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2010---2025-05-17
-[2.0.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#209---2022-09-16
-[2.0.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#208---2022-09-01
-[2.0.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#207---2022-08-22
-[2.0.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#206---2022-07-13
-[2.0.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#205---2022-07-07
-[2.0.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#204---2022-07-01
-[2.0.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#203---2022-06-28
-[2.0.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#202---2022-06-24
-[2.0.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#201---2022-06-22
-[2.0.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#200---2022-06-21
-
-[2.0.17-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.17/README.md
-[2.0.16-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.16/README.md
-[2.0.15-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.15/README.md
-[2.0.14-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.14/README.md
-[2.0.13-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.13/README.md
-[2.0.12-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.12/README.md
-[2.0.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.11/README.md
-[2.0.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.10/README.md
-[2.0.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.9/README.md
-[2.0.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.8/README.md
-[2.0.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.7/README.md
-[2.0.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.6/README.md
-[2.0.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.5/README.md
-[2.0.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.4/README.md
-[2.0.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.3/README.md
-[2.0.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.2/README.md
-[2.0.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.1/README.md
-[2.0.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.0/README.md
-
-### Older Releases
-
-<details>
-  <summary>1.4.x CHANGELOGs and READMEs</summary>
-
-| Version | Release Date | CHANGELOG                             | README                          |
-|---------|--------------|---------------------------------------|---------------------------------|
-| 1.4.11  | Sep 16, 2022 | [v1.4.11 CHANGELOG][1.4.11-changelog] | [v1.4.11 README][1.4.11-readme] |
-| 1.4.10  | Jul 1, 2022  | [v1.4.10 CHANGELOG][1.4.10-changelog] | [v1.4.10 README][1.4.10-readme] |
-| 1.4.9   | Feb 20, 2022 | [v1.4.9 CHANGELOG][1.4.9-changelog]   | [v1.4.9 README][1.4.9-readme]   |
-| 1.4.8   | Feb 18, 2022 | [v1.4.8 CHANGELOG][1.4.8-changelog]   | [v1.4.8 README][1.4.8-readme]   |
-| 1.4.7   | Mar 19, 2021 | [v1.4.7 CHANGELOG][1.4.7-changelog]   | [v1.4.7 README][1.4.7-readme]   |
-| 1.4.6   | Mar 19, 2021 | [v1.4.6 CHANGELOG][1.4.6-changelog]   | [v1.4.6 README][1.4.6-readme]   |
-| 1.4.5   | Mar 18, 2021 | [v1.4.5 CHANGELOG][1.4.5-changelog]   | [v1.4.5 README][1.4.5-readme]   |
-| 1.4.4   | Feb 12, 2020 | [v1.4.4 CHANGELOG][1.4.4-changelog]   | [v1.4.4 README][1.4.4-readme]   |
-| 1.4.3   | Jan 29, 2020 | [v1.4.3 CHANGELOG][1.4.3-changelog]   | [v1.4.3 README][1.4.3-readme]   |
-| 1.4.2   | Oct 1, 2019  | [v1.4.2 CHANGELOG][1.4.2-changelog]   | [v1.4.2 README][1.4.2-readme]   |
-| 1.4.1   | Oct 13, 2018 | [v1.4.1 CHANGELOG][1.4.1-changelog]   | [v1.4.1 README][1.4.1-readme]   |
-| 1.4.0   | Jun 9, 2017  | [v1.4.0 CHANGELOG][1.4.0-changelog]   | [v1.4.0 README][1.4.0-readme]   |
-</details>
+  <summary>Need enterprise-level guarantees?</summary>
 
-[1.4.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1411---2022-09-16
-[1.4.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1410---2022-07-01
-[1.4.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#149---2022-02-20
-[1.4.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#148---2022-02-18
-[1.4.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#147---2021-03-19
-[1.4.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#146---2021-03-19
-[1.4.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#145---2021-03-18
-[1.4.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#144---2020-02-12
-[1.4.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#143---2020-01-29
-[1.4.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#142---2019-10-01
-[1.4.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#141---2018-10-13
-[1.4.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#140---2017-06-09
-
-[1.4.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.11/README.md
-[1.4.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.10/README.md
-[1.4.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.9/README.md
-[1.4.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.8/README.md
-[1.4.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.7/README.md
-[1.4.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.6/README.md
-[1.4.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.5/README.md
-[1.4.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.4/README.md
-[1.4.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.3/README.md
-[1.4.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.2/README.md
-[1.4.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.1/README.md
-[1.4.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.0/README.md
+  <p>The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.</p>
 
-<details>
-  <summary>1.3.x Readmes</summary>
+  <p><a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme"><img src="https://img.shields.io/badge/Tidelift_and_Sonar-Enterprise_Support-FD3456?style=for-the-badge&amp;logo=sonar&amp;logoColor=white" alt="Get help from me on Tidelift"></a></p>
 
-| Version | Release Date | Readme                                                       |
-|---------|--------------|--------------------------------------------------------------|
-| 1.3.1   | Mar 3, 2017  | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.1/README.md |
-| 1.3.0   | Dec 27, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.0/README.md |
+  <ul>
+    <li>💡Subscribe for support guarantees covering <em>all</em> your FLOSS dependencies</li>
+    <li>💡Tidelift is part of <a href="https://blog.tidelift.com/tidelift-joins-sonar">Sonar</a>
+</li>
+    <li>💡Tidelift pays maintainers to maintain the software you depend on!<br>📊<code>@</code>Pointy Haired Boss: An <a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme">enterprise support</a> subscription is “<a href="https://www.youtube.com/watch?v=dQw4w9WgXcQ">never gonna let you down</a>”, and <em>supports</em> open source maintainers</li>
+  </ul>
 
-</details>
+  <p>Alternatively:</p>
 
-<details>
-  <summary>≤= 1.2.x Readmes (2016 and before)</summary>
-
-| Version | Release Date | Readme                                                       |
-|---------|--------------|--------------------------------------------------------------|
-| 1.2.0   | Jun 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.2.0/README.md |
-| 1.1.0   | Jan 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.1.0/README.md |
-| 1.0.0   | May 23, 2014 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.0.0/README.md |
-| &lt; 1.0.0 | Find here    | https://gitlab.com/ruby-oauth/oauth2/-/tags                  |
+  <ul>
+    <li><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a></li>
+    <li><a href="https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share"><img src="https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&amp;logo=Upwork&amp;logoColor=white" alt="Get help from me on Upwork"></a></li>
+    <li><a href="https://www.codementor.io/peterboling?utm_source=github&amp;utm_medium=button&amp;utm_term=peterboling&amp;utm_campaign=github"><img src="https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&amp;logo=CodeMentor&amp;logoColor=white" alt="Get help from me on Codementor"></a></li>
+  </ul>
 
 </details>
 
-## ✨ Installation
+<h2 id="installation">✨ Installation</h2>
 
-Install the gem and add to the application's Gemfile by executing:
+<p>Install the gem and add to the application’s Gemfile by executing:</p>
 
-```console
+<p><code>console
 bundle add oauth2
-```
+</code></p>
 
-If bundler is not being used to manage dependencies, install the gem by executing:
+<p>If bundler is not being used to manage dependencies, install the gem by executing:</p>
 
-```console
+<p><code>console
 gem install oauth2
-```
+</code></p>
 
-### 🔒 Secure Installation
+<h3 id="secure-installation">🔒 Secure Installation</h3>
 
 <details>
   <summary>For Medium or High Security Installations</summary>
 
-This gem is cryptographically signed and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
-[stone_checksums][💎stone_checksums]. Be sure the gem you install hasn’t been tampered with
-by following the instructions below.
+  <p>This gem is cryptographically signed, and has verifiable <a href="https://gitlab.com/ruby-oauth/oauth2/-/tree/main/checksums">SHA-256 and SHA-512</a> checksums by
+<a href="https://github.com/galtzo-floss/stone_checksums">stone_checksums</a>. Be sure the gem you install hasn’t been tampered with
+by following the instructions below.</p>
 
-Add my public key (if you haven’t already; will expire 2045-04-29) as a trusted certificate:
+  <p>Add my public key (if you haven’t already, expires 2045-04-29) as a trusted certificate:</p>
 
-```console
+  <p><code>console
 gem cert --add &lt;(curl -Ls https://raw.github.com/galtzo-floss/certs/main/pboling.pem)
-```
+</code></p>
 
-You only need to do that once.  Then proceed to install with:
+  <p>You only need to do that once.  Then proceed to install with:</p>
 
-```console
+  <p><code>console
 gem install oauth2 -P MediumSecurity
-```
+</code></p>
 
-The `MediumSecurity` trust profile will verify signed gems, but allow the installation of unsigned dependencies.
+  <p>The <code>MediumSecurity</code> trust profile will verify signed gems, but allow the installation of unsigned dependencies.</p>
 
-This is necessary because not all of `oauth2`’s dependencies are signed, so we cannot use `HighSecurity`.
+  <p>This is necessary because not all of <code>oauth2</code>’s dependencies are signed, so we cannot use <code>HighSecurity</code>.</p>
 
-If you want to up your security game full-time:
+  <p>If you want to up your security game full-time:</p>
 
-```console
+  <p><code>console
 bundle config set --global trust-policy MediumSecurity
-```
+</code></p>
 
-NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.
+  <p><code>MediumSecurity</code> instead of <code>HighSecurity</code> is necessary if not all the gems you use are signed.</p>
+
+  <p>NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.</p>
 
 </details>
 
-## What is new for v2.0?
-
-- Works with Ruby versions &gt;= 2.2
-- Drop support for the expired MAC Draft (all versions)
-- Support IETF rfc7515 JSON Web Signature - JWS (since v2.0.12)
-    - Support JWT `kid` for key discovery and management
-- Support IETF rfc7523 JWT Bearer Tokens (since v2.0.0)
-- Support IETF rfc7231 Relative Location in Redirect (since v2.0.0)
-- Support IETF rfc6749 Don't set oauth params when nil (since v2.0.0)
-- Support IETF rfc7009 Token Revocation (since v2.0.10, updated in v2.0.13 to support revocation via URL-encoded parameters)
-- Support [OIDC 1.0 Private Key JWT](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication); based on the OAuth JWT assertion specification [(RFC 7523)](https://tools.ietf.org/html/rfc7523)
-- Support new formats, including from [jsonapi.org](http://jsonapi.org/format/): `application/vdn.api+json`, `application/vnd.collection+json`, `application/hal+json`, `application/problem+json`
-- Adds option to `OAuth2::Client#get_token`:
-    - `:access_token_class` (`AccessToken`); user specified class to use for all calls to `get_token`
-- Adds option to `OAuth2::AccessToken#initialize`:
-    - `:expires_latency` (`nil`); number of seconds by which AccessToken validity will be reduced to offset latency
-- By default, keys are transformed to snake case.
-    - Original keys will still work as previously, in most scenarios, thanks to [snaky_hash][snaky_hash] gem.
-    - However, this is a _breaking_ change if you rely on `response.parsed.to_h` to retain the original case, and the original wasn't snake case, as the keys in the result will be snake case.
-    - As of version 2.0.4 you can turn key transformation off with the `snaky: false` option.
-- By default, the `:auth_scheme` is now `:basic_auth` (instead of `:request_body`)
-    - Third-party strategies and gems may need to be updated if a provider was requiring client id/secret in the request body
-- [... A lot more](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md#200-2022-06-21-tag)
-
-[snaky_hash]: https://gitlab.com/ruby-oauth/snaky_hash
-
-## Compatibility
-
-Targeted ruby compatibility is non-EOL versions of Ruby, currently 3.2, 3.3, and 3.4.
-Compatibility is further distinguished as "Best Effort Support" or "Incidental Support" for older versions of Ruby.
+<h2 id="what-is-new-for-v20">What is new for v2.0?</h2>
+
+<ul>
+  <li>Works with Ruby versions &gt;= 2.2</li>
+  <li>Drop support for the expired MAC Draft (all versions)</li>
+  <li>Support IETF rfc7515 JSON Web Signature - JWS (since v2.0.12)
+    <ul>
+      <li>Support JWT <code>kid</code> for key discovery and management</li>
+    </ul>
+  </li>
+  <li>Support IETF rfc7523 JWT Bearer Tokens (since v2.0.0)</li>
+  <li>Support IETF rfc7231 Relative Location in Redirect (since v2.0.0)</li>
+  <li>Support IETF rfc6749 Don’t set oauth params when nil (since v2.0.0)</li>
+  <li>Support IETF rfc7009 Token Revocation (since v2.0.10, updated in v2.0.13 to support revocation via URL-encoded parameters)</li>
+  <li>Support <a href="https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC 1.0 Private Key JWT</a>; based on the OAuth JWT assertion specification <a href="https://tools.ietf.org/html/rfc7523">(RFC 7523)</a>
+</li>
+  <li>Support new formats, including from <a href="http://jsonapi.org/format/">jsonapi.org</a>: <code>application/vdn.api+json</code>, <code>application/vnd.collection+json</code>, <code>application/hal+json</code>, <code>application/problem+json</code>
+</li>
+  <li>Adds option to <code>OAuth2::Client#get_token</code>:
+    <ul>
+      <li>
+<code>:access_token_class</code> (<code>AccessToken</code>); user specified class to use for all calls to <code>get_token</code>
+</li>
+    </ul>
+  </li>
+  <li>Adds option to <code>OAuth2::AccessToken#initialize</code>:
+    <ul>
+      <li>
+<code>:expires_latency</code> (<code>nil</code>); number of seconds by which AccessToken validity will be reduced to offset latency</li>
+    </ul>
+  </li>
+  <li>By default, keys are transformed to snake case.
+    <ul>
+      <li>Original keys will still work as previously, in most scenarios, thanks to <a href="https://gitlab.com/ruby-oauth/snaky_hash">snaky_hash</a> gem.</li>
+      <li>However, this is a <em>breaking</em> change if you rely on <code>response.parsed.to_h</code> to retain the original case, and the original wasn’t snake case, as the keys in the result will be snake case.</li>
+      <li>As of version 2.0.4 you can turn key transformation off with the <code>snaky: false</code> option.</li>
+    </ul>
+  </li>
+  <li>By default, the <code>:auth_scheme</code> is now <code>:basic_auth</code> (instead of <code>:request_body</code>)
+    <ul>
+      <li>Third-party strategies and gems may need to be updated if a provider was requiring client id/secret in the request body</li>
+    </ul>
+  </li>
+  <li><a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md#200-2022-06-21-tag">… A lot more</a></li>
+</ul>
+
+<h2 id="compatibility-1">Compatibility</h2>
+
+<p>Targeted ruby compatibility is non-EOL versions of Ruby, currently 3.2, 3.3, and 3.4.
+Compatibility is further distinguished as “Best Effort Support” or “Incidental Support” for older versions of Ruby.
 This gem will install on Ruby versions &gt;= v2.2 for 2.x releases.
-See `1-4-stable` branch for older rubies.
+See <code>1-4-stable</code> branch for older rubies.</p>
 
-<details>
-  <summary>Ruby Engine Compatibility Policy</summary>
+<p>&lt;details markdown=”1&gt;</p>
+<summary>Ruby Engine Compatibility Policy</summary>
 
-This gem is tested against MRI, JRuby, and Truffleruby.
+<p>This gem is tested against MRI, JRuby, and Truffleruby.
 Each of those has varying versions that target a specific version of MRI Ruby.
 This gem should work in the just-listed Ruby engines according to the targeted MRI compatibility in the table below.
 If you would like to add support for additional engines,
-see [gemfiles/README.md](gemfiles/README.md), then submit a PR to the correct maintenance branch as according to the table below.
-</details>
+see <a href="gemfiles/README.md">gemfiles/README.md</a>, then submit a PR to the correct maintenance branch as according to the table below.</p>
 
-<details>
-  <summary>Ruby Version Compatibility Policy</summary>
+<p>&lt;/details&gt;</p>
+
+<p>&lt;details markdown=”1&gt;</p>
+<summary>Ruby Version Compatibility Policy</summary>
 
-If something doesn't work on one of these interpreters, it's a bug.
+<p>If something doesn’t work on one of these interpreters, it’s a bug.</p>
 
-This library may inadvertently work (or seem to work) on other Ruby
+<p>This library may inadvertently work (or seem to work) on other Ruby
 implementations; however, support will only be provided for the versions listed
-above.
+above.</p>
 
-If you would like this library to support another Ruby version, you may
+<p>If you would like this library to support another Ruby version, you may
 volunteer to be a maintainer. Being a maintainer entails making sure all tests
 run and pass on that implementation. When something breaks on your
 implementation, you will be responsible for providing patches in a timely
 fashion. If critical issues for a particular implementation exist at the time
-of a major release, support for that Ruby version may be dropped.
-</details>
-
-|     | Ruby OAuth2 Version | Maintenance Branch | Targeted Support     | Best Effort Support     | Incidental Support           |
-|:----|---------------------|--------------------|----------------------|-------------------------|------------------------------|
-| 1️⃣ | 2.0.x               | `main`             | 3.2, 3.3, 3.4        | 2.5, 2.6, 2.7, 3.0, 3.1 | 2.2, 2.3, 2.4                |
-| 2️⃣ | 1.4.x               | `1-4-stable`       | 3.2, 3.3, 3.4        | 2.5, 2.6, 2.7, 3.0, 3.1 | 1.9, 2.0, 2.1, 2.2, 2.3, 2.4 |
-| 3️⃣ | older               | N/A                | Best of luck to you! | Please upgrade!         |                              |
-
-NOTE: The 1.4 series will only receive critical security updates.
-See [SECURITY.md][🔐security] and [IRP.md][🔐irp].
-
-## ⚙️ Configuration
-
-You can turn on additional warnings.
-
-```ruby
+of a major release, support for that Ruby version may be dropped.</p>
+
+<p>&lt;/details&gt;</p>
+
+<table>
+  <thead>
+    <tr>
+      <th style="text-align: left"> </th>
+      <th>Ruby OAuth2 Version</th>
+      <th>Maintenance Branch</th>
+      <th>Targeted Support</th>
+      <th>Best Effort Support</th>
+      <th>Incidental Support</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td style="text-align: left">1️⃣</td>
+      <td>2.0.x</td>
+      <td><code>main</code></td>
+      <td>3.2, 3.3, 3.4</td>
+      <td>2.5, 2.6, 2.7, 3.0, 3.1</td>
+      <td>2.2, 2.3, 2.4</td>
+    </tr>
+    <tr>
+      <td style="text-align: left">2️⃣</td>
+      <td>1.4.x</td>
+      <td><code>1-4-stable</code></td>
+      <td>3.2, 3.3, 3.4</td>
+      <td>2.5, 2.6, 2.7, 3.0, 3.1</td>
+      <td>1.9, 2.0, 2.1, 2.2, 2.3, 2.4</td>
+    </tr>
+    <tr>
+      <td style="text-align: left">3️⃣</td>
+      <td>older</td>
+      <td>N/A</td>
+      <td>Best of luck to you!</td>
+      <td>Please upgrade!</td>
+      <td> </td>
+    </tr>
+  </tbody>
+</table>
+
+<p>NOTE: The 1.4 series will only receive critical security updates.
+See <a href="SECURITY.md">SECURITY.md</a> and <a href="IRP.md">IRP.md</a>.</p>
+
+<h2 id="configuration">⚙️ Configuration</h2>
+
+<p>You can turn on additional warnings.</p>
+
+<p><code>ruby
 OAuth2.configure do |config|
   # Turn on a warning like:
   #   OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key
@@ -577,54 +633,56 @@ <h3 id="quick-examples">Quick Examples</h3>
   # Set to true if you want to also show warnings about no tokens
   config.silence_no_tokens_warning = false # default: true,
 end
-```
+</code></p>
 
-The "extra tokens" problem comes from ambiguity in the spec about which token is the right token.
+<p>The “extra tokens” problem comes from ambiguity in the spec about which token is the right token.
 Some OAuth 2.0 standards legitimately have multiple tokens.
-You may need to subclass `OAuth2::AccessToken`, or write your own custom alternative to it, and pass it in.
-Specify your custom class with the `access_token_class` option.
+You may need to subclass <code>OAuth2::AccessToken</code>, or write your own custom alternative to it, and pass it in.
+Specify your custom class with the <code>access_token_class</code> option.</p>
 
-If you only need one token, you can, as of v2.0.10,
-specify the exact token name you want to extract via the `OAuth2::AccessToken` using
-the `token_name` option.
+<p>If you only need one token, you can, as of v2.0.10,
+specify the exact token name you want to extract via the <code>OAuth2::AccessToken</code> using
+the <code>token_name</code> option.</p>
 
-You'll likely need to do some source diving.
+<p>You’ll likely need to do some source diving.
 This gem has 100% test coverage for lines and branches, so the specs are a great place to look for ideas.
-If you have time and energy, please contribute to the documentation!
+If you have time and energy, please contribute to the documentation!</p>
 
-## 🔧 Basic Usage
+<h2 id="basic-usage">🔧 Basic Usage</h2>
 
-### `authorize_url` and `token_url` are on site root (Just Works!)
+<h3 id="authorizeurl-and-tokenurl-are-on-site-root-just-works">
+<code>authorize_url</code> and <code>token_url</code> are on site root (Just Works!)</h3>
 
-```ruby
-require "oauth2"
-client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org")
-# =&gt; #&lt;OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
-client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth2/callback")
-# =&gt; "https://example.org/oauth/authorize?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code"
+<p>```ruby
+require “oauth2”
+client = OAuth2::Client.new(“client_id”, “client_secret”, site: “https://example.org”)
+# =&gt; #&lt;OAuth2::Client:0x00000001204c8288 @id=”client_id”, @secret=”client_sec…
+client.auth_code.authorize_url(redirect_uri: “http://localhost:8080/oauth2/callback”)
+# =&gt; “https://example.org/oauth/authorize?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code”</p>
 
-access = client.auth_code.get_token("authorization_code_value", redirect_uri: "http://localhost:8080/oauth2/callback", headers: =&gt; "Basic some_password")
-response = access.get("/api/resource", params: =&gt; "bar")
+<p>access = client.auth_code.get_token(“authorization_code_value”, redirect_uri: “http://localhost:8080/oauth2/callback”, headers: {”Authorization” =&gt; “Basic some_password”})
+response = access.get(“/api/resource”, params: {”query_foo” =&gt; “bar”})
 response.class.name
 # =&gt; OAuth2::Response
-```
+```</p>
 
-### Relative `authorize_url` and `token_url` (Not on site root, Just Works!)
+<h3 id="relative-authorizeurl-and-tokenurl-not-on-site-root-just-works">Relative <code>authorize_url</code> and <code>token_url</code> (Not on site root, Just Works!)</h3>
 
-In the above example, the default Authorization URL is `oauth/authorize` and default Access Token URL is `oauth/token`, and, as they are missing a leading `/`, both are relative.
+<p>In the above example, the default Authorization URL is <code>oauth/authorize</code> and default Access Token URL is <code>oauth/token</code>, and, as they are missing a leading <code>/</code>, both are relative.</p>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org/nested/directory/on/your/server")
 # =&gt; #&lt;OAuth2::Client:0x00000001204c8288 @id="client_id", @secret="client_sec...
 client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth2/callback")
 # =&gt; "https://example.org/nested/directory/on/your/server/oauth/authorize?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code"
-```
+</code></p>
 
-### Customize `authorize_url` and `token_url`
+<h3 id="customize-authorizeurl-and-tokenurl">Customize <code>authorize_url</code> and <code>token_url</code>
+</h3>
 
-You can specify custom URLs for authorization and access token, and when using a leading `/` they will _not be relative_, as shown below:
+<p>You can specify custom URLs for authorization and access token, and when using a leading <code>/</code> they will <em>not be relative</em>, as shown below:</p>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(
   "client_id",
   "client_secret",
@@ -637,105 +695,109 @@ <h3 id="quick-examples">Quick Examples</h3>
 # =&gt; "https://example.org/jaunty/authorize/?client_id=client_id&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth2%2Fcallback&amp;response_type=code"
 client.class.name
 # =&gt; OAuth2::Client
-```
+</code></p>
 
-### snake_case and indifferent access in Response#parsed
+<h3 id="snakecase-and-indifferent-access-in-responseparsed">snake_case and indifferent access in Response#parsed</h3>
 
-```ruby
-response = access.get("/api/resource", params: =&gt; "bar")
+<p><code>ruby
+response = access.get("/api/resource", params: {"query_foo" =&gt; "bar"})
 # Even if the actual response is CamelCase. it will be made available as snaky:
-JSON.parse(response.body)         # =&gt; "additionalData"=&gt;"additional"
-response.parsed                   # =&gt; "additional_data"=&gt;"additional"
+JSON.parse(response.body)         # =&gt; {"accessToken"=&gt;"aaaaaaaa", "additionalData"=&gt;"additional"}
+response.parsed                   # =&gt; {"access_token"=&gt;"aaaaaaaa", "additional_data"=&gt;"additional"}
 response.parsed.access_token      # =&gt; "aaaaaaaa"
 response.parsed[:access_token]    # =&gt; "aaaaaaaa"
 response.parsed.additional_data   # =&gt; "additional"
 response.parsed[:additional_data] # =&gt; "additional"
 response.parsed.class.name        # =&gt; SnakyHash::StringKeyed (from snaky_hash gem)
-```
+</code></p>
 
-#### Serialization
+<h4 id="serialization">Serialization</h4>
 
-As of v2.0.11, if you need to serialize the parsed result, you can!
+<p>As of v2.0.11, if you need to serialize the parsed result, you can!</p>
 
-There are two ways to do this, globally, or discretely.  The discrete way is recommended.
+<p>There are two ways to do this, globally, or discretely.  The discrete way is recommended.</p>
 
-##### Global Serialization Config
+<h5 id="global-serialization-config">Global Serialization Config</h5>
 
-Globally configure `SnakyHash::StringKeyed` to use the serializer. Put this in your code somewhere reasonable (like an initializer for Rails).
+<p>Globally configure <code>SnakyHash::StringKeyed</code> to use the serializer. Put this in your code somewhere reasonable (like an initializer for Rails).</p>
 
-```ruby
+<p><code>ruby
 SnakyHash::StringKeyed.class_eval do
   extend SnakyHash::Serializer
 end
-```
+</code></p>
 
-##### Discrete Serialization Config
+<h5 id="discrete-serialization-config">Discrete Serialization Config</h5>
 
-Discretely configure a custom Snaky Hash class to use the serializer.
+<p>Discretely configure a custom Snaky Hash class to use the serializer.</p>
 
-```ruby
+<p>```ruby
 class MySnakyHash &lt; SnakyHash::StringKeyed
-  # Give this hash class `dump` and `load` abilities!
+  # Give this hash class <code>dump</code> and <code>load</code> abilities!
   extend SnakyHash::Serializer
-end
+end</p>
 
-# And tell your client to use the custom class in each call:
-client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org/oauth2")
-token = client.get_token(MySnakyHash)
-```
+<h1 id="and-tell-your-client-to-use-the-custom-class-in-each-call">And tell your client to use the custom class in each call:</h1>
+<p>client = OAuth2::Client.new(“client_id”, “client_secret”, site: “https://example.org/oauth2”)
+token = client.get_token({snaky_hash_klass: MySnakyHash})
+```</p>
 
-##### Serialization Extensions
+<h5 id="serialization-extensions">Serialization Extensions</h5>
 
-These extensions work regardless of whether you used the global or discrete config above.
+<p>These extensions work regardless of whether you used the global or discrete config above.</p>
 
-There are a few hacks you may need in your class to support Ruby &lt; 2.4.2 or &lt; 2.6.
+<p>There are a few hacks you may need in your class to support Ruby &lt; 2.4.2 or &lt; 2.6.
 They are likely not needed if you are on a newer Ruby.
-See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb) if you need to study the hacks for older Rubies.
+Expand the examples below, or the <a href="https://gitlab.com/ruby-oauth/snaky_hash">ruby-oauth/snaky_hash</a> gem,
+or <a href="https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb">response_spec.rb</a>, for more ideas, especially if you need to study the hacks for older Rubies.</p>
+
+<p>&lt;details markdown=”1&gt;</p>
+<summary>See Examples</summary>
 
-```ruby
+<p>```ruby
 class MySnakyHash &lt; SnakyHash::StringKeyed
-  # Give this hash class `dump` and `load` abilities!
-  extend SnakyHash::Serializer
+  # Give this hash class <code>dump</code> and <code>load</code> abilities!
+  extend SnakyHash::Serializer</p>
 
-  #### Serialization Extentions
+<p>#### Serialization Extentions
   #
   # Act on the non-hash values (including the values of hashes) as they are dumped to JSON
   # In other words, this retains nested hashes, and only the deepest leaf nodes become bananas.
   # WARNING: This is a silly example!
   dump_value_extensions.add(:to_fruit) do |value|
-    "banana" # =&gt; Make values "banana" on dump
-  end
+    “banana” # =&gt; Make values “banana” on dump
+  end</p>
 
-  # Act on the non-hash values (including the values of hashes) as they are loaded from the JSON dump
-  # In other words, this retains nested hashes, and only the deepest leaf nodes become ***.
+<p># Act on the non-hash values (including the values of hashes) as they are loaded from the JSON dump
+  # In other words, this retains nested hashes, and only the deepest leaf nodes become <strong><em>.
   # WARNING: This is a silly example!
   load_value_extensions.add(:to_stars) do |value|
-    "***" # Turn dumped bananas into *** when they are loaded
-  end
+    “</em></strong>” # Turn dumped bananas into *** when they are loaded
+  end</p>
 
-  # Act on the entire hash as it is prepared for dumping to JSON
+<p># Act on the entire hash as it is prepared for dumping to JSON
   # WARNING: This is a silly example!
   dump_hash_extensions.add(:to_cheese) do |value|
     if value.is_a?(Hash)
       value.transform_keys do |key|
-        split = key.split("_")
+        split = key.split(“_”)
         first_word = split[0]
-        key.sub(first_word, "cheese")
+        key.sub(first_word, “cheese”)
       end
     else
       value
     end
-  end
+  end</p>
 
-  # Act on the entire hash as it is loaded from the JSON dump
+<p># Act on the entire hash as it is loaded from the JSON dump
   # WARNING: This is a silly example!
   load_hash_extensions.add(:to_pizza) do |value|
     if value.is_a?(Hash)
       res = klass.new
       value.keys.each_with_object(res) do |key, result|
-        split = key.split("_")
+        split = key.split(“_”)
         last_word = split[-1]
-        new_key = key.sub(last_word, "pizza")
+        new_key = key.sub(last_word, “pizza”)
         result[new_key] = value[key]
       end
       res
@@ -744,35 +806,35 @@ <h3 id="quick-examples">Quick Examples</h3>
     end
   end
 end
-```
+```</p>
 
-See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem for more ideas.
+<p>&lt;/details&gt;</p>
 
-#### Prefer camelCase over snake_case? =&gt; snaky: false
+<h4 id="prefer-camelcase-over-snakecase--snaky-false">Prefer camelCase over snake_case? =&gt; snaky: false</h4>
 
-```ruby
-response = access.get("/api/resource", params: =&gt; "bar", snaky: false)
-JSON.parse(response.body)         # =&gt; "additionalData"=&gt;"additional"
-response.parsed                   # =&gt; "additionalData"=&gt;"additional"
+<p><code>ruby
+response = access.get("/api/resource", params: {"query_foo" =&gt; "bar"}, snaky: false)
+JSON.parse(response.body)         # =&gt; {"accessToken"=&gt;"aaaaaaaa", "additionalData"=&gt;"additional"}
+response.parsed                   # =&gt; {"accessToken"=&gt;"aaaaaaaa", "additionalData"=&gt;"additional"}
 response.parsed["accessToken"]    # =&gt; "aaaaaaaa"
 response.parsed["additionalData"] # =&gt; "additional"
 response.parsed.class.name        # =&gt; Hash (just, regular old Hash)
-```
+</code></p>
 
 <details>
   <summary>Debugging &amp; Logging</summary>
 
-Set an environment variable as per usual (e.g. with [dotenv](https://github.com/bkeepers/dotenv)).
+  <p>Set an environment variable as per usual (e.g. with <a href="https://github.com/bkeepers/dotenv">dotenv</a>).</p>
 
-```ruby
+  <p><code>ruby
 # will log both request and response, including bodies
 ENV["OAUTH_DEBUG"] = "true"
-```
+</code></p>
 
-By default, debug output will go to `$stdout`. This can be overridden when
-initializing your OAuth2::Client.
+  <p>By default, debug output will go to <code>$stdout</code>. This can be overridden when
+initializing your OAuth2::Client.</p>
 
-```ruby
+  <p><code>ruby
 require "oauth2"
 client = OAuth2::Client.new(
   "client_id",
@@ -780,304 +842,377 @@ <h3 id="quick-examples">Quick Examples</h3>
   site: "https://example.org",
   logger: Logger.new("example.log", "weekly"),
 )
-```
+</code></p>
+
 </details>
 
-### OAuth2::Response
+<h3 id="oauth2response">OAuth2::Response</h3>
 
-The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic `#request`
-will return an instance of the #OAuth2::Response class.
+<p>The <code>AccessToken</code> methods <code>#get</code>, <code>#post</code>, <code>#put</code> and <code>#delete</code> and the generic <code>#request</code>
+will return an instance of the #OAuth2::Response class.</p>
 
-This instance contains a `#parsed` method that will parse the response body and
-return a Hash-like [`SnakyHash::StringKeyed`](https://gitlab.com/ruby-oauth/snaky_hash/-/blob/main/lib/snaky_hash/string_keyed.rb) if the `Content-Type` is `application/x-www-form-urlencoded` or if
+<p>This instance contains a <code>#parsed</code> method that will parse the response body and
+return a Hash-like <a href="https://gitlab.com/ruby-oauth/snaky_hash/-/blob/main/lib/snaky_hash/string_keyed.rb"><code>SnakyHash::StringKeyed</code></a> if the <code>Content-Type</code> is <code>application/x-www-form-urlencoded</code> or if
 the body is a JSON object.  It will return an Array if the body is a JSON
-array.  Otherwise, it will return the original body string.
+array.  Otherwise, it will return the original body string.</p>
 
-The original response body, headers, and status can be accessed via their
-respective methods.
+<p>The original response body, headers, and status can be accessed via their
+respective methods.</p>
 
-### OAuth2::AccessToken
+<h3 id="oauth2accesstoken">OAuth2::AccessToken</h3>
 
-If you have an existing Access Token for a user, you can initialize an instance
-using various class methods including the standard new, `from_hash` (if you have
-a hash of the values), or `from_kvform` (if you have an
-`application/x-www-form-urlencoded` encoded string of the values).
+<p>If you have an existing Access Token for a user, you can initialize an instance
+using various class methods including the standard new, <code>from_hash</code> (if you have
+a hash of the values), or <code>from_kvform</code> (if you have an
+<code>application/x-www-form-urlencoded</code> encoded string of the values).</p>
+
+<p>Options (since v2.0.x unless noted):</p>
+
+<ul>
+  <li>
+    <table>
+      <tbody>
+        <tr>
+          <td>
+<code>expires_latency</code> (Integer</td>
+          <td>nil): Seconds to subtract from expires_in when computing #expired? to offset latency.</td>
+        </tr>
+      </tbody>
+    </table>
+  </li>
+  <li>
+    <table>
+      <tbody>
+        <tr>
+          <td>
+<code>token_name</code> (String</td>
+          <td>Symbol</td>
+          <td>nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).</td>
+        </tr>
+      </tbody>
+    </table>
+  </li>
+  <li>
+    <table>
+      <tbody>
+        <tr>
+          <td>
+<code>mode</code> (Symbol</td>
+          <td>Proc</td>
+          <td>Hash): Controls how the token is transmitted on requests made via this AccessToken instance.</td>
+        </tr>
+      </tbody>
+    </table>
+    <ul>
+      <li>
+<code>:header</code> — Send as Authorization: Bearer <token> header (default and preferred by OAuth 2.1 draft guidance).</token>
+</li>
+      <li>
+<code>:query</code> — Send as access_token query parameter (discouraged in general, but required by some providers).</li>
+      <li>Verb-dependent (since v2.0.15): Provide either:
+        <ul>
+          <li>a <code>Proc</code> taking <code>|verb|</code> and returning <code>:header</code> or <code>:query</code>, or</li>
+          <li>a <code>Hash</code> with verb symbols as keys, for example <code>{get: :query, post: :header, delete: :header}</code>.</li>
+        </ul>
+      </li>
+    </ul>
+  </li>
+</ul>
 
-Options (since v2.0.x unless noted):
-- `expires_latency` (Integer | nil): Seconds to subtract from expires_in when computing #expired? to offset latency.
-- `token_name` (String | Symbol | nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).
-- `mode` (Symbol | Proc | Hash): Controls how the token is transmitted on requests made via this AccessToken instance.
-  - `:header` — Send as Authorization: Bearer <token> header (default and preferred by OAuth 2.1 draft guidance).
-  - `:query` — Send as access_token query parameter (discouraged in general, but required by some providers).
-  - Verb-dependent (since v2.0.15): Provide either:
-    - a `Proc` taking `|verb|` and returning `:header` or `:query`, or
-    - a `Hash` with verb symbols as keys, for example `:query, post: :header, delete: :header`.
+<p>Note: Verb-dependent mode supports providers like Instagram that require query mode for <code>GET</code> and header mode for <code>POST</code>/<code>DELETE</code></p>
 
-Note: Verb-dependent mode supports providers like Instagram that require query mode for `GET` and header mode for `POST`/`DELETE`
-- Verb-dependent mode via `Proc` was added in v2.0.15
-- Verb-dependent mode via `Hash` was added in v2.0.16
+<ul>
+  <li>Verb-dependent mode via <code>Proc</code> was added in v2.0.15</li>
+  <li>Verb-dependent mode via <code>Hash</code> was added in v2.0.16</li>
+</ul>
 
-### OAuth2::Error
+<h3 id="oauth2error">OAuth2::Error</h3>
 
-On 400+ status code responses, an `OAuth2::Error` will be raised.  If it is a
-standard OAuth2 error response, the body will be parsed and `#code` and `#description` will contain the values provided from the error and
-`error_description` parameters.  The `#response` property of `OAuth2::Error` will
-always contain the `OAuth2::Response` instance.
+<p>On 400+ status code responses, an <code>OAuth2::Error</code> will be raised.  If it is a
+standard OAuth2 error response, the body will be parsed and <code>#code</code> and <code>#description</code> will contain the values provided from the error and
+<code>error_description</code> parameters.  The <code>#response</code> property of <code>OAuth2::Error</code> will
+always contain the <code>OAuth2::Response</code> instance.</p>
 
-If you do not want an error to be raised, you may use `:raise_errors =&gt; false`
-option on initialization of the client.  In this case the `OAuth2::Response`
+<p>If you do not want an error to be raised, you may use <code>:raise_errors =&gt; false</code>
+option on initialization of the client.  In this case the <code>OAuth2::Response</code>
 instance will be returned as usual and on 400+ status code responses, the
-Response instance will contain the `OAuth2::Error` instance.
-
-### Authorization Grants
-
-Note on OAuth 2.1 (draft):
-- PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.
-- Redirect URIs must be compared using exact string matching by the Authorization Server.
-- The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.
-- Bearer tokens in the query string are omitted due to security risks; prefer Authorization header usage.
-- Refresh tokens for public clients must either be sender-constrained (e.g., DPoP/MTLS) or one-time use.
-- The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.
-
-References:
-- OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
-- Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
-- FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1
-- Okta: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs
-- Video: https://www.youtube.com/watch?v=g_aVPdwBTfw
-- Differences overview: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/
-
-Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
+Response instance will contain the <code>OAuth2::Error</code> instance.</p>
+
+<h3 id="authorization-grants">Authorization Grants</h3>
+
+<p>Note on OAuth 2.1 (draft):</p>
+
+<ul>
+  <li>PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.</li>
+  <li>Redirect URIs must be compared using exact string matching by the Authorization Server.</li>
+  <li>The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.</li>
+  <li>Bearer tokens in the query string are omitted due to security risks; prefer Authorization header usage.</li>
+  <li>Refresh tokens for public clients must either be sender-constrained (e.g., DPoP/MTLS) or one-time use.</li>
+  <li>The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.</li>
+</ul>
+
+<p>References:</p>
+
+<ul>
+  <li>OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13</li>
+  <li>Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1</li>
+  <li>FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1</li>
+  <li>Okta: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs</li>
+  <li>Video: https://www.youtube.com/watch?v=g_aVPdwBTfw</li>
+  <li>Differences overview: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/</li>
+</ul>
+
+<p>Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
 authentication grant types have helper strategy classes that simplify client
-use. They are available via the [`#auth_code`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
-[`#implicit`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb),
-[`#password`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/password.rb),
-[`#client_credentials`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb), and
-[`#assertion`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
-
-These aren't full examples, but demonstrative of the differences between usage for each strategy.
-```ruby
-auth_url = client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth/callback")
-access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback")
-
-auth_url = client.implicit.authorize_url(redirect_uri: "http://localhost:8080/oauth/callback")
+use. They are available via the <a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb"><code>#auth_code</code></a>,
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb"><code>#implicit</code></a>,
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/password.rb"><code>#password</code></a>,
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb"><code>#client_credentials</code></a>, and
+<a href="https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb"><code>#assertion</code></a> methods respectively.</p>
+
+<p>These aren’t full examples, but demonstrative of the differences between usage for each strategy.</p>
+
+<p>```ruby
+auth_url = client.auth_code.authorize_url(redirect_uri: “http://localhost:8080/oauth/callback”)
+access = client.auth_code.get_token(“code_value”, redirect_uri: “http://localhost:8080/oauth/callback”)</p>
+
+<p>auth_url = client.implicit.authorize_url(redirect_uri: “http://localhost:8080/oauth/callback”)
 # get the token params in the callback and
-access = OAuth2::AccessToken.from_kvform(client, query_string)
+access = OAuth2::AccessToken.from_kvform(client, query_string)</p>
 
-access = client.password.get_token("username", "password")
+<p>access = client.password.get_token(“username”, “password”)</p>
 
-access = client.client_credentials.get_token
+<p>access = client.client_credentials.get_token</p>
 
-# Client Assertion Strategy
-# see: https://tools.ietf.org/html/rfc7523
+<h1 id="client-assertion-strategy">Client Assertion Strategy</h1>
+<p># see: https://tools.ietf.org/html/rfc7523
 claimset = {
-  iss: "http://localhost:3001",
-  aud: "http://localhost:8080/oauth2/token",
-  sub: "me@example.com",
+  iss: “http://localhost:3001”,
+  aud: “http://localhost:8080/oauth2/token”,
+  sub: “me@example.com”,
   exp: Time.now.utc.to_i + 3600,
 }
-assertion_params = [claimset, "HS256", "secret_key"]
-access = client.assertion.get_token(assertion_params)
+assertion_params = [claimset, “HS256”, “secret_key”]
+access = client.assertion.get_token(assertion_params)</p>
 
-# The `access` (i.e. access token) is then used like so:
-access.token # actual access_token string, if you need it somewhere
-access.get("/api/stuff") # making api calls with access token
-```
+<h1 id="the-access-ie-access-token-is-then-used-like-so">The <code>access</code> (i.e. access token) is then used like so:</h1>
+<p>access.token # actual access_token string, if you need it somewhere
+access.get(“/api/stuff”) # making api calls with access token
+```</p>
 
-If you want to specify additional headers to be sent out with the
-request, add a 'headers' hash under 'params':
+<p>If you want to specify additional headers to be sent out with the
+request, add a ‘headers’ hash under ‘params’:</p>
 
-```ruby
-access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback", headers: =&gt; "Header")
-```
+<p><code>ruby
+access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback", headers: {"Some" =&gt; "Header"})
+</code></p>
 
-You can always use the `#request` method on the `OAuth2::Client` instance to make
-requests for tokens for any Authentication grant type.
+<p>You can always use the <code>#request</code> method on the <code>OAuth2::Client</code> instance to make
+requests for tokens for any Authentication grant type.</p>
 
-## 📘 Comprehensive Usage
+<h2 id="comprehensive-usage">📘 Comprehensive Usage</h2>
 
-### Common Flows (end-to-end)
+<h3 id="common-flows-end-to-end">Common Flows (end-to-end)</h3>
 
-- Authorization Code (server-side web app):
+<ul>
+  <li>Authorization Code (server-side web app):</li>
+</ul>
 
-```ruby
-require "oauth2"
+<p>```ruby
+require “oauth2”
 client = OAuth2::Client.new(
-  ENV["CLIENT_ID"],
-  ENV["CLIENT_SECRET"],
-  site: "https://provider.example.com",
-  redirect_uri: "https://my.app.example.com/oauth/callback",
-)
-
-# Step 1: redirect user to consent
-state = SecureRandom.hex(16)
-auth_url = client.auth_code.authorize_url(scope: "openid profile email", state: state)
-# redirect_to auth_url
-
-# Step 2: handle the callback
-# params[:code], params[:state]
-raise "state mismatch" unless params[:state] == state
-access = client.auth_code.get_token(params[:code])
+  ENV[“CLIENT_ID”],
+  ENV[“CLIENT_SECRET”],
+  site: “https://provider.example.com”,
+  redirect_uri: “https://my.app.example.com/oauth/callback”,
+)</p>
+
+<h1 id="step-1-redirect-user-to-consent">Step 1: redirect user to consent</h1>
+<p>state = SecureRandom.hex(16)
+auth_url = client.auth_code.authorize_url(scope: “openid profile email”, state: state)
+# redirect_to auth_url</p>
+
+<h1 id="step-2-handle-the-callback">Step 2: handle the callback</h1>
+<p># params[:code], params[:state]
+raise “state mismatch” unless params[:state] == state
+access = client.auth_code.get_token(params[:code])</p>
+
+<h1 id="step-3-call-apis">Step 3: call APIs</h1>
+<p>profile = access.get(“/api/v1/me”).parsed
+```</p>
 
-# Step 3: call APIs
-profile = access.get("/api/v1/me").parsed
-```
-
-- Client Credentials (machine-to-machine):
+<ul>
+  <li>Client Credentials (machine-to-machine):</li>
+</ul>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(ENV["CLIENT_ID"], ENV["CLIENT_SECRET"], site: "https://provider.example.com")
 access = client.client_credentials.get_token(audience: "https://api.example.com")
 resp = access.get("/v1/things")
-```
+</code></p>
 
-- Resource Owner Password (legacy; avoid when possible):
+<ul>
+  <li>Resource Owner Password (legacy; avoid when possible):</li>
+</ul>
 
-```ruby
+<p><code>ruby
 access = client.password.get_token("jdoe", "s3cret", scope: "read")
-```
+</code></p>
 
-#### Examples
+<h4 id="examples">Examples</h4>
 
 <details>
-<summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
+  <summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
 
-```ruby
+  <p>```ruby
 # This converts a Postman/Net::HTTP multipart token request to oauth2 gem usage.
 # JHipster UAA typically exposes the token endpoint at /uaa/oauth/token.
 # The original snippet included:
 # - Basic Authorization header for the client (web_app:changeit)
 # - X-XSRF-TOKEN header from a cookie (some deployments require it)
 # - grant_type=password with username/password and client_id
-# Using oauth2 gem, you don't need to build multipart bodies; the gem sends
-# application/x-www-form-urlencoded as required by RFC 6749.
+# Using oauth2 gem, you don’t need to build multipart bodies; the gem sends
+# application/x-www-form-urlencoded as required by RFC 6749.</p>
 
-require "oauth2"
+  <p>require “oauth2”</p>
 
-client = OAuth2::Client.new(
-  "web_app",            # client_id
-  "changeit",           # client_secret
-  site: "http://localhost:8080/uaa",
-  token_url: "/oauth/token",      # absolute under site (or "oauth/token" relative)
+  <p>client = OAuth2::Client.new(
+  “web_app”,            # client_id
+  “changeit”,           # client_secret
+  site: “http://localhost:8080/uaa”,
+  token_url: “/oauth/token”,      # absolute under site (or “oauth/token” relative)
   auth_scheme: :basic_auth,         # sends HTTP Basic Authorization header
-)
+)</p>
 
-# If your UAA requires an XSRF header for the token call, provide it as a header.
-# Often this is not required for token endpoints, but if your gateway enforces it,
+  <h1 id="if-your-uaa-requires-an-xsrf-header-for-the-token-call-provide-it-as-a-header">If your UAA requires an XSRF header for the token call, provide it as a header.</h1>
+  <p># Often this is not required for token endpoints, but if your gateway enforces it,
 # obtain the value from the XSRF-TOKEN cookie and pass it here.
-xsrf_token = ENV["X_XSRF_TOKEN"] # e.g., pulled from a prior set-cookie value
+xsrf_token = ENV[“X_XSRF_TOKEN”] # e.g., pulled from a prior set-cookie value</p>
 
-access = client.password.get_token(
-  "admin",                 # username
-  "admin",                 # password
-  headers: xsrf_token ? =&gt; xsrf_token : {},
+  <p>access = client.password.get_token(
+  “admin”,                 # username
+  “admin”,                 # password
+  headers: xsrf_token ? {”X-XSRF-TOKEN” =&gt; xsrf_token} : {},
   # JHipster commonly also accepts/needs the client_id in the body; include if required:
-  # client_id: "web_app",
-)
+  # client_id: “web_app”,
+)</p>
 
-puts access.token
+  <p>puts access.token
 puts access.to_hash # full token response
-```
+```</p>
 
-Notes:
-- Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.
-- If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often "/" or a login page) and pass it to headers.
-- For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.
+  <p>Notes:</p>
+
+  <ul>
+    <li>Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.</li>
+    <li>If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often “/” or a login page) and pass it to headers.</li>
+    <li>For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.</li>
+  </ul>
 
 </details>
 
-### Instagram API (verb‑dependent token mode)
+<h3 id="instagram-api-verbdependent-token-mode">Instagram API (verb‑dependent token mode)</h3>
+
+<p>Providers like Instagram require the access token to be sent differently depending on the HTTP verb:</p>
 
-Providers like Instagram require the access token to be sent differently depending on the HTTP verb:
-- GET requests: token must be in the query string (?access_token=...)
-- POST/DELETE requests: token must be in the Authorization header (Bearer ...)
+<ul>
+  <li>GET requests: token must be in the query string (?access_token=…)</li>
+  <li>POST/DELETE requests: token must be in the Authorization header (Bearer …)</li>
+</ul>
 
-Since v2.0.15, you can configure an AccessToken with a verb‑dependent mode. The gem will choose how to send the token based on the request method.
+<p>Since v2.0.15, you can configure an AccessToken with a verb‑dependent mode. The gem will choose how to send the token based on the request method.</p>
 
-Example: exchanging and refreshing long‑lived Instagram tokens, and making API calls
+<p>Example: exchanging and refreshing long‑lived Instagram tokens, and making API calls</p>
 
-```ruby
-require "oauth2"
+<p>```ruby
+require “oauth2”</p>
 
-# NOTE: Users authenticate via Facebook Login to obtain a short‑lived user token (not shown here).
-# See Facebook Login docs for obtaining the initial short‑lived token.
+<h1 id="note-users-authenticate-via-facebook-login-to-obtain-a-shortlived-user-token-not-shown-here">NOTE: Users authenticate via Facebook Login to obtain a short‑lived user token (not shown here).</h1>
+<p># See Facebook Login docs for obtaining the initial short‑lived token.</p>
 
-client = OAuth2::Client.new(nil, nil, site: "https://graph.instagram.com")
+<p>client = OAuth2::Client.new(nil, nil, site: “https://graph.instagram.com”)</p>
 
-# Start with a short‑lived token you already obtained via Facebook Login
-short_lived = OAuth2::AccessToken.new(
+<h1 id="start-with-a-shortlived-token-you-already-obtained-via-facebook-login">Start with a short‑lived token you already obtained via Facebook Login</h1>
+<p>short_lived = OAuth2::AccessToken.new(
   client,
-  ENV["IG_SHORT_LIVED_TOKEN"],
+  ENV[“IG_SHORT_LIVED_TOKEN”],
   # Key part: verb‑dependent mode
-  mode: :query, post: :header, delete: :header,
-)
+  mode: {get: :query, post: :header, delete: :header},
+)</p>
 
-# 1) Exchange for a long‑lived token (Instagram requires GET with access_token in query)
-#    Endpoint: GET https://graph.instagram.com/access_token
+<h1 id="exchange-for-a-longlived-token-instagram-requires-get-with-accesstoken-in-query">1) Exchange for a long‑lived token (Instagram requires GET with access_token in query)</h1>
+<p>#    Endpoint: GET https://graph.instagram.com/access_token
 #    Params: grant_type=ig_exchange_token, client_secret=APP_SECRET
 exchange = short_lived.get(
-  "/access_token",
+  “/access_token”,
   params: {
-    grant_type: "ig_exchange_token",
-    client_secret: ENV["IG_APP_SECRET"],
+    grant_type: “ig_exchange_token”,
+    client_secret: ENV[“IG_APP_SECRET”],
     # access_token param will be added automatically by the AccessToken (mode =&gt; :query for GET)
   },
 )
-long_lived_token_value = exchange.parsed["access_token"]
+long_lived_token_value = exchange.parsed[“access_token”]</p>
 
-long_lived = OAuth2::AccessToken.new(
+<p>long_lived = OAuth2::AccessToken.new(
   client,
   long_lived_token_value,
-  mode: :query, post: :header, delete: :header,
-)
+  mode: {get: :query, post: :header, delete: :header},
+)</p>
 
-# 2) Refresh the long‑lived token (Instagram uses GET with token in query)
-#    Endpoint: GET https://graph.instagram.com/refresh_access_token
+<h1 id="refresh-the-longlived-token-instagram-uses-get-with-token-in-query">2) Refresh the long‑lived token (Instagram uses GET with token in query)</h1>
+<p>#    Endpoint: GET https://graph.instagram.com/refresh_access_token
 refresh_resp = long_lived.get(
-  "/refresh_access_token",
-  params: "ig_refresh_token",
+  “/refresh_access_token”,
+  params: {grant_type: “ig_refresh_token”},
 )
 long_lived = OAuth2::AccessToken.new(
   client,
-  refresh_resp.parsed["access_token"],
-  mode: :query, post: :header, delete: :header,
-)
+  refresh_resp.parsed[“access_token”],
+  mode: {get: :query, post: :header, delete: :header},
+)</p>
 
-# 3) Typical API GET request (token in query automatically)
-me = long_lived.get("/me", params: "id,username").parsed
+<h1 id="typical-api-get-request-token-in-query-automatically">3) Typical API GET request (token in query automatically)</h1>
+<p>me = long_lived.get(“/me”, params: {fields: “id,username”}).parsed</p>
 
-# 4) Example POST (token sent via Bearer header automatically)
-# Note: Replace the path/params with a real Instagram Graph API POST you need,
+<h1 id="example-post-token-sent-via-bearer-header-automatically">4) Example POST (token sent via Bearer header automatically)</h1>
+<p># Note: Replace the path/params with a real Instagram Graph API POST you need,
 # such as publishing media via the Graph API endpoints.
-# long_lived.post("/me/media", body: "https://...", caption: "hello")
-```
+# long_lived.post(“/me/media”, body: {image_url: “https://…”, caption: “hello”})
+```</p>
 
-Tips:
-- Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for GET.
-- If you need a custom rule, you can pass a Proc for mode, e.g. mode: -&gt;(verb) { verb == :get ? :query : :header }.
+<p>Tips:</p>
 
-### Refresh Tokens
+<ul>
+  <li>Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for <code>GET</code> requests.</li>
+  <li>If you need a custom rule, you can pass a <code>Proc</code> for <code>mode</code>, e.g. <code>mode: -&gt;(verb) { verb == :get ? :query : :header }</code>.</li>
+</ul>
 
-When the server issues a refresh_token, you can refresh manually or implement an auto-refresh wrapper.
+<h3 id="refresh-tokens">Refresh Tokens</h3>
 
-- Manual refresh:
+<p>When the server issues a refresh_token, you can refresh manually or implement an auto-refresh wrapper.</p>
 
-```ruby
+<ul>
+  <li>Manual refresh:</li>
+</ul>
+
+<p><code>ruby
 if access.expired?
   access = access.refresh
 end
-```
+</code></p>
 
-- Auto-refresh wrapper pattern:
+<ul>
+  <li>Auto-refresh wrapper pattern:</li>
+</ul>
 
-```ruby
+<p>```ruby
 class AutoRefreshingToken
   def initialize(token_provider, store: nil)
     @token = token_provider
     @store = store # e.g., something that responds to read/write for token data
-  end
+  end</p>
 
-  def with(&amp;blk)
+<p>def with(&amp;blk)
     tok = ensure_fresh!
     blk ? blk.call(tok) : tok
   rescue OAuth2::Error =&gt; e
@@ -1088,180 +1223,193 @@ <h3 id="quick-examples">Quick Examples</h3>
       retry
     end
     raise
-  end
+  end</p>
 
-private
+<p>private</p>
 
-  def ensure_fresh!
+<p>def ensure_fresh!
     if @token.expired? &amp;&amp; @token.refresh_token
       @token = @token.refresh
       @store.write(@token.to_hash) if @store
     end
     @token
   end
-end
+end</p>
 
-# usage
-keeper = AutoRefreshingToken.new(access)
-keeper.with { |tok| tok.get("/v1/protected") }
-```
+<h1 id="usage">usage</h1>
+<p>keeper = AutoRefreshingToken.new(access)
+keeper.with { |tok| tok.get(“/v1/protected”) }
+```</p>
 
-Persist the token across processes using `AccessToken#to_hash` and `AccessToken.from_hash(client, hash)`.
+<p>Persist the token across processes using <code>AccessToken#to_hash</code> and <code>AccessToken.from_hash(client, hash)</code>.</p>
 
-### Token Revocation (RFC 7009)
+<h3 id="token-revocation-rfc-7009">Token Revocation (RFC 7009)</h3>
 
-You can revoke either the access token or the refresh token.
+<p>You can revoke either the access token or the refresh token.</p>
 
-```ruby
+<p>```ruby
 # Revoke the current access token
-access.revoke(token_type_hint: :access_token)
+access.revoke(token_type_hint: :access_token)</p>
 
-# Or explicitly revoke the refresh token (often also invalidates associated access tokens)
-access.revoke(token_type_hint: :refresh_token)
-```
+<h1 id="or-explicitly-revoke-the-refresh-token-often-also-invalidates-associated-access-tokens">Or explicitly revoke the refresh token (often also invalidates associated access tokens)</h1>
+<p>access.revoke(token_type_hint: :refresh_token)
+```</p>
 
-### Client Configuration Tips
+<h3 id="client-configuration-tips">Client Configuration Tips</h3>
 
-#### Mutual TLS (mTLS) client authentication
+<h4 id="mutual-tls-mtls-client-authentication">Mutual TLS (mTLS) client authentication</h4>
 
-Some providers require OAuth requests (including the token request and subsequent API calls) to be sender‑constrained using mutual TLS (mTLS). With this gem, you enable mTLS by providing a client certificate/private key to Faraday via connection_opts.ssl and, if your provider requires it for client authentication, selecting the tls_client_auth auth_scheme.
+<p>Some providers require OAuth requests (including the token request and subsequent API calls) to be sender‑constrained using mutual TLS (mTLS). With this gem, you enable mTLS by providing a client certificate/private key to Faraday via connection_opts.ssl and, if your provider requires it for client authentication, selecting the tls_client_auth auth_scheme.</p>
 
-Example using PEM files (certificate and key):
+<p>Example using PEM files (certificate and key):</p>
 
-```ruby
-require "oauth2"
-require "openssl"
+<p>```ruby
+require “oauth2”
+require “openssl”</p>
 
-client = OAuth2::Client.new(
-  ENV.fetch("CLIENT_ID"),
-  ENV.fetch("CLIENT_SECRET"),
-  site: "https://example.com",
-  authorize_url: "/oauth/authorize/",
-  token_url: "/oauth/token/",
+<p>client = OAuth2::Client.new(
+  ENV.fetch(“CLIENT_ID”),
+  ENV.fetch(“CLIENT_SECRET”),
+  site: “https://example.com”,
+  authorize_url: “/oauth/authorize/”,
+  token_url: “/oauth/token/”,
   auth_scheme: :tls_client_auth, # if your AS requires mTLS-based client authentication
   connection_opts: {
     ssl: {
-      client_cert: OpenSSL::X509::Certificate.new(File.read("localhost.pem")),
-      client_key: OpenSSL::PKey::RSA.new(File.read("localhost-key.pem")),
+      client_cert: OpenSSL::X509::Certificate.new(File.read(“localhost.pem”)),
+      client_key: OpenSSL::PKey::RSA.new(File.read(“localhost-key.pem”)),
       # Optional extras, uncomment as needed:
-      # ca_file: "/path/to/ca-bundle.pem",   # custom CA(s)
+      # ca_file: “/path/to/ca-bundle.pem”,   # custom CA(s)
       # verify: true                           # enable server cert verification (recommended)
     },
   },
-)
+)</p>
+
+<h1 id="example-token-request-any-grant-type-can-be-used-the-mtls-handshake">Example token request (any grant type can be used). The mTLS handshake</h1>
+<p># will occur automatically on HTTPS calls using the configured cert/key.
+access = client.client_credentials.get_token</p>
+
+<h1 id="subsequent-resource-requests-will-also-use-mtls-on-https-endpoints-of-site">Subsequent resource requests will also use mTLS on HTTPS endpoints of <code>site</code>:</h1>
+<p>resp = access.get(“/v1/protected”)
+```</p>
 
-# Example token request (any grant type can be used). The mTLS handshake
-# will occur automatically on HTTPS calls using the configured cert/key.
-access = client.client_credentials.get_token
-
-# Subsequent resource requests will also use mTLS on HTTPS endpoints of `site`:
-resp = access.get("/v1/protected")
-```
-
-Notes:
-- Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"]).
-- If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
-  - p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])
-  - client_cert = p12.certificate; client_key = p12.key
-- Server trust:
-  - If your environment does not have system CAs, specify ca_file or ca_path inside the ssl: hash.
-  - Keep verify: true in production. Set verify: false only for local testing.
-- Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. net_http (default) and net_http_persistent are common choices.
-- Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).
-- OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via auth_scheme: :tls_client_auth as shown above.
-
-#### Authentication schemes for the token request
-
-```ruby
+<p>Notes:</p>
+
+<ul>
+  <li>Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to <code>OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"])</code>.</li>
+  <li>If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
+    <ul>
+      <li><code>p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])</code></li>
+      <li><code>client_cert = p12.certificate; client_key = p12.key</code></li>
+    </ul>
+  </li>
+  <li>Server trust:
+    <ul>
+      <li>If your environment does not have system CAs, specify <code>ca_file</code> or <code>ca_path</code> inside the <code>ssl:</code> hash.</li>
+      <li>Keep <code>verify: true</code> in production. Set <code>verify: false</code> only for local testing.</li>
+    </ul>
+  </li>
+  <li>Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. <code>net_http</code> (default) and <code>net_http_persistent</code> are common choices.</li>
+  <li>Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).</li>
+  <li>OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via <code>auth_scheme: :tls_client_auth</code> as shown above.</li>
+</ul>
+
+<h4 id="authentication-schemes-for-the-token-request">Authentication schemes for the token request</h4>
+
+<p><code>ruby
 OAuth2::Client.new(
   id,
   secret,
   site: "https://provider.example.com",
   auth_scheme: :basic_auth, # default. Alternatives: :request_body, :tls_client_auth, :private_key_jwt
 )
-```
+</code></p>
 
-#### Faraday connection, timeouts, proxy, custom adapter/middleware:
+<h4 id="faraday-connection-timeouts-proxy-custom-adaptermiddleware">Faraday connection, timeouts, proxy, custom adapter/middleware:</h4>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(
   id,
   secret,
   site: "https://provider.example.com",
   connection_opts: {
-    request: 5, timeout: 15,
+    request: {open_timeout: 5, timeout: 15},
     proxy: ENV["HTTPS_PROXY"],
-    ssl: true,
+    ssl: {verify: true},
   },
 ) do |faraday|
   faraday.request(:url_encoded)
   # faraday.response :logger, Logger.new($stdout) # see OAUTH_DEBUG below
   faraday.adapter(:net_http_persistent) # or any Faraday adapter you need
 end
-```
+</code></p>
 
-##### Using flat query params (Faraday::FlatParamsEncoder)
+<h5 id="using-flat-query-params-faradayflatparamsencoder">Using flat query params (<code>Faraday::FlatParamsEncoder</code>)</h5>
 
-Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides FlatParamsEncoder for this purpose. You can configure the oauth2 client to use it when building requests.
+<p>Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides <code>FlatParamsEncoder</code> for this purpose. You can configure the oauth2 client to use it when building requests.</p>
 
-```ruby
-require "faraday"
+<p>```ruby
+require “faraday”</p>
 
-client = OAuth2::Client.new(
+<p>client = OAuth2::Client.new(
   id,
   secret,
-  site: "https://api.example.com",
+  site: “https://api.example.com”,
   # Pass Faraday connection options to make FlatParamsEncoder the default
   connection_opts: {
-    request: Faraday::FlatParamsEncoder,
+    request: {params_encoder: Faraday::FlatParamsEncoder},
   },
 ) do |faraday|
   faraday.request(:url_encoded)
   faraday.adapter(:net_http)
-end
+end</p>
 
-access = client.client_credentials.get_token
+<p>access = client.client_credentials.get_token</p>
 
-# Example of a GET with two flat filter params (not an array):
-# Results in: ?filter=order.clientCreatedTime%3E1445006997000&amp;filter=order.clientCreatedTime%3C1445611797000
+<h1 id="example-of-a-get-with-two-flat-filter-params-not-an-array">Example of a GET with two flat filter params (not an array):</h1>
+<p># Results in: ?filter=order.clientCreatedTime%3E1445006997000&amp;filter=order.clientCreatedTime%3C1445611797000
 resp = access.get(
-  "/v1/orders",
+  “/v1/orders”,
   params: {
     # Provide the values as an array; FlatParamsEncoder expands them as repeated keys
     filter: [
-      "order.clientCreatedTime&gt;1445006997000",
-      "order.clientCreatedTime&lt;1445611797000",
+      “order.clientCreatedTime&gt;1445006997000”,
+      “order.clientCreatedTime&lt;1445611797000”,
     ],
   },
 )
-```
+```</p>
 
-If you instead need to build a raw Faraday connection yourself, the equivalent configuration is:
+<p>If you instead need to build a raw Faraday connection yourself, the equivalent configuration is:</p>
 
-```ruby
-conn = Faraday.new("https://api.example.com", request: Faraday::FlatParamsEncoder)
-```
+<p><code>ruby
+conn = Faraday.new("https://api.example.com", request: {params_encoder: Faraday::FlatParamsEncoder})
+</code></p>
 
-#### Redirection
+<h4 id="redirection">Redirection</h4>
 
-The library follows up to `max_redirects` (default 5).
-You can override per-client via `options[:max_redirects]`.
+<p>The library follows up to <code>max_redirects</code> (default 5).
+You can override per-client via <code>options[:max_redirects]</code>.</p>
 
-### Handling Responses and Errors
+<h3 id="handling-responses-and-errors">Handling Responses and Errors</h3>
 
-- Parsing:
+<ul>
+  <li>Parsing:</li>
+</ul>
 
-```ruby
+<p><code>ruby
 resp = access.get("/v1/thing")
 resp.status     # Integer
 resp.headers    # Hash
 resp.body       # String
 resp.parsed     # SnakyHash::StringKeyed or Array when JSON array
-```
+</code></p>
 
-- Error handling:
+<ul>
+  <li>Error handling:</li>
+</ul>
 
-```ruby
+<p><code>ruby
 begin
   access.get("/v1/forbidden")
 rescue OAuth2::Error =&gt; e
@@ -1269,150 +1417,155 @@ <h3 id="quick-examples">Quick Examples</h3>
   e.description  # OAuth2 error description (when present)
   e.response     # OAuth2::Response (full access to status/headers/body)
 end
-```
+</code></p>
 
-- Disable raising on 4xx/5xx to inspect the response yourself:
+<ul>
+  <li>Disable raising on 4xx/5xx to inspect the response yourself:</li>
+</ul>
 
-```ruby
+<p><code>ruby
 client = OAuth2::Client.new(id, secret, site: site, raise_errors: false)
 res = client.request(:get, "/v1/maybe-errors")
 if res.status == 429
   sleep res.headers["retry-after"].to_i
 end
-```
+</code></p>
 
-### Making Raw Token Requests
+<h3 id="making-raw-token-requests">Making Raw Token Requests</h3>
 
-If a provider requires non-standard parameters or headers, you can call `client.get_token` directly:
+<p>If a provider requires non-standard parameters or headers, you can call <code>client.get_token</code> directly:</p>
 
-```ruby
+<p><code>ruby
 access = client.get_token({
   grant_type: "client_credentials",
   audience: "https://api.example.com",
-  headers: =&gt; "value",
+  headers: {"X-Custom" =&gt; "value"},
   parse: :json, # override parsing
 })
-```
+</code></p>
 
-### OpenID Connect (OIDC) Notes
+<h3 id="openid-connect-oidc-notes">OpenID Connect (OIDC) Notes</h3>
 
-- If the token response includes an `id_token` (a JWT), this gem surfaces it but does not validate the signature. Use a JWT library and your provider's JWKs to verify it.
-- For private_key_jwt client authentication, provide `auth_scheme: :private_key_jwt` and ensure your key configuration matches the provider requirements.
-- See [OIDC.md](OIDC.md) for a more complete OIDC overview, example, and links to the relevant specifications.
+<ul>
+  <li>If the token response includes an <code>id_token</code> (a JWT), this gem surfaces it but does not validate the signature. Use a JWT library and your provider’s JWKs to verify it.</li>
+  <li>For private_key_jwt client authentication, provide <code>auth_scheme: :private_key_jwt</code> and ensure your key configuration matches the provider requirements.</li>
+  <li>See <a href="OIDC.md">OIDC.md</a> for a more complete OIDC overview, example, and links to the relevant specifications.</li>
+</ul>
 
-### Debugging
+<h3 id="debugging">Debugging</h3>
 
-- Set environment variable `OAUTH_DEBUG=true` to enable verbose Faraday logging (uses the client-provided logger).
-- To mirror a working curl request, ensure you set the same auth scheme, params, and content type. The Quick Example at the top shows a curl-to-ruby translation.
+<ul>
+  <li>Set environment variable <code>OAUTH_DEBUG=true</code> to enable verbose Faraday logging (uses the client-provided logger).</li>
+  <li>To mirror a working curl request, ensure you set the same auth scheme, params, and content type. The Quick Example at the top shows a curl-to-ruby translation.</li>
+</ul>
 
----
+<hr>
 
-## 🦷 FLOSS Funding
+<h2 id="floss-funding">🦷 FLOSS Funding</h2>
 
-While ruby-oauth tools are free software and will always be, the project would benefit immensely from some funding.
-Raising a monthly budget of... "dollars" would make the project more sustainable.
+<p>While ruby-oauth tools are free software and will always be, the project would benefit immensely from some funding.
+Raising a monthly budget of… “dollars” would make the project more sustainable.</p>
 
-We welcome both individual and corporate sponsors! We also offer a
+<p>We welcome both individual and corporate sponsors! We also offer a
 wide array of funding channels to account for your preferences
-(although currently [Open Collective][🖇osc] is our preferred funding platform).
+(although currently <a href="https://opencollective.com/ruby-oauth">Open Collective</a> is our preferred funding platform).</p>
 
-**If you're working in a company that's making significant use of ruby-oauth tools we'd
-appreciate it if you suggest to your company to become a ruby-oauth sponsor.**
+<p><strong>If you’re working in a company that’s making significant use of ruby-oauth tools we’d
+appreciate it if you suggest to your company to become a ruby-oauth sponsor.</strong></p>
 
-You can support the development of ruby-oauth tools via
-[GitHub Sponsors][🖇sponsor],
-[Liberapay][⛳liberapay],
-[PayPal][🖇paypal],
-[Open Collective][🖇osc]
-and [Tidelift][🏙️entsup-tidelift].
+<p>You can support the development of ruby-oauth tools via
+<a href="https://github.com/sponsors/pboling">GitHub Sponsors</a>,
+<a href="https://liberapay.com/pboling/donate">Liberapay</a>,
+<a href="https://www.paypal.com/paypalme/peterboling">PayPal</a>,
+<a href="https://opencollective.com/ruby-oauth">Open Collective</a>
+and <a href="https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme">Tidelift</a>.</p>
 
-| 📍 NOTE                                                                                                                                                                                                              |
-|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| If doing a sponsorship in the form of donation is problematic for your company <br> from an accounting standpoint, we'd recommend the use of Tidelift, <br> where you can get a support-like subscription instead. |
+<table>
+  <thead>
+    <tr>
+      <th>📍 NOTE</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>If doing a sponsorship in the form of donation is problematic for your company <br> from an accounting standpoint, we’d recommend the use of Tidelift, <br> where you can get a support-like subscription instead.</td>
+    </tr>
+  </tbody>
+</table>
 
-### Open Collective for Individuals
+<h3 id="open-collective-for-individuals">Open Collective for Individuals</h3>
 
-Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/kettle-rb#backer)]
+<p>Support us with a monthly donation and help us continue our activities. [<a href="https://opencollective.com/ruby-oauth#backer">Become a backer</a>]</p>
 
-NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
+<p>NOTE: <a href="https://github.com/ruby-oauth/oauth2/blob/main/exe/kettle-readme-backers">kettle-readme-backers</a> updates this list every day, automatically.</p>
 
 <!-- OPENCOLLECTIVE-INDIVIDUALS:START -->
-No backers yet. Be the first!
-<!-- OPENCOLLECTIVE-INDIVIDUALS:END -->
+<p>No backers yet. Be the first!
+<!-- OPENCOLLECTIVE-INDIVIDUALS:END --></p>
 
-### Open Collective for Organizations
+<h3 id="open-collective-for-organizations">Open Collective for Organizations</h3>
 
-Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/kettle-rb#sponsor)]
+<p>Become a sponsor and get your logo on our README on GitHub with a link to your site. [<a href="https://opencollective.com/ruby-oauth#sponsor">Become a sponsor</a>]</p>
 
-NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
+<p>NOTE: <a href="https://github.com/ruby-oauth/oauth2/blob/main/exe/kettle-readme-backers">kettle-readme-backers</a> updates this list every day, automatically.</p>
 
 <!-- OPENCOLLECTIVE-ORGANIZATIONS:START -->
-No sponsors yet. Be the first!
-
-### Open Collective for Donors
-
-<a href="https://opencollective.com/ruby-oauth/backer/0/website" target="_blank"><img src="https://opencollective.com/ruby-oauth/backer/0/avatar.svg"></a>
+<p>No sponsors yet. Be the first!
+<!-- OPENCOLLECTIVE-ORGANIZATIONS:END --></p>
 
-<!-- OPENCOLLECTIVE-ORGANIZATIONS:END -->
+<h3 id="another-way-to-support-open-source">Another way to support open-source</h3>
 
-[kettle-readme-backers]: https://github.com/kettle-rb/kettle-dev/blob/main/exe/kettle-readme-backers
+<p>I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).</p>
 
-### Another way to support open-source
+<p>If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in <code>bundle fund</code>.</p>
 
-&gt; How wonderful it is that nobody need wait a single moment before starting to improve the world.<br>
-&gt;—Anne Frank
+<p>I’m developing a new library, <a href="https://github.com/galtzo-floss/floss_funding">floss_funding</a>, designed to empower open-source developers like myself to get paid for the work we do, in a sustainable way. Please give it a look.</p>
 
-I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small.  Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions — totaling 79 hours of FLOSS coding over just the past seven days, a pretty regular week for me.  I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
+<p><strong><a href="https://floss-funding.dev">Floss-Funding.dev</a>: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags</strong></p>
 
-If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
+<p><a href="https://opencollective.com/ruby-oauth#backer"><img src="https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat" alt="OpenCollective Backers"></a> <a href="https://opencollective.com/ruby-oauth#sponsor"><img src="https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat" alt="OpenCollective Sponsors"></a> <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github" alt="Sponsor Me on Github"></a> <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat" alt="Liberapay Goal Progress"></a> <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal" alt="Donate on PayPal"></a> <a href="https://www.buymeacoffee.com/pboling"><img src="https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat" alt="Buy me a coffee"></a> <a href="https://polar.sh/pboling"><img src="https://img.shields.io/badge/polar-donate-a51611.svg?style=flat" alt="Donate on Polar"></a> <a href="https://ko-fi.com/O5O86SNP4"><img src="https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat" alt="Donate to my FLOSS efforts at ko-fi.com"></a> <a href="https://patreon.com/galtzo"><img src="https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat" alt="Donate to my FLOSS efforts using Patreon"></a></p>
 
-I’m developing a new library, [floss_funding][🖇floss-funding-gem], designed to empower open-source developers like myself to get paid for the work we do, in a sustainable way. Please give it a look.
+<h2 id="security">🔐 Security</h2>
 
-**[Floss-Funding.dev][🖇floss-funding.dev]: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags**
+<p>To report a security vulnerability, please use the <a href="https://tidelift.com/security">Tidelift security contact</a>.
+Tidelift will coordinate the fix and disclosure.</p>
 
-[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS or refugee efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS or refugee efforts using Patreon][🖇patreon-img]][🖇patreon]
+<p>For more see <a href="SECURITY.md">SECURITY.md</a>, <a href="THREAT_MODEL.md">THREAT_MODEL.md</a>, and <a href="IRP.md">IRP.md</a>.</p>
 
-## 🔐 Security
+<h2 id="contributing">🤝 Contributing</h2>
 
-To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
-Tidelift will coordinate the fix and disclosure.
+<p>If you need some ideas of where to help, you could work on adding more code coverage,
+or if it is already 💯 (see <a href="#code-coverage">below</a>) check <a href="REEK">reek</a>, <a href="https://github.com/ruby-oauth/oauth2/issues">issues</a>, or <a href="https://github.com/ruby-oauth/oauth2/pulls">PRs</a>,
+or use the gem and think about how it could be better.</p>
 
-For more see [SECURITY.md][🔐security], [THREAT_MODEL.md][🔐threat-model], and [IRP.md][🔐irp].
+<p>We <a href="https://keepachangelog.com/en/1.0.0/"><img src="https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat" alt="Keep A Changelog"></a> so if you make changes, remember to update it.</p>
 
-## 🤝 Contributing
+<p>See <a href="CONTRIBUTING.md">CONTRIBUTING.md</a> for more detailed instructions.</p>
 
-If you need some ideas of where to help, you could work on adding more code coverage,
-or if it is already 💯 (see [below](#code-coverage)) check [reek](REEK), [issues][🤝gh-issues], or [PRs][🤝gh-pulls],
-or use the gem and think about how it could be better.
+<h3 id="release-instructions">🚀 Release Instructions</h3>
 
-We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
+<p>See <a href="CONTRIBUTING.md">CONTRIBUTING.md</a>.</p>
 
-See [CONTRIBUTING.md][🤝contributing] for more detailed instructions.
+<h3 id="code-coverage">Code Coverage</h3>
 
-### 🚀 Release Instructions
+<p><a href="https://codecov.io/gh/ruby-oauth/oauth2"><img src="https://codecov.io/gh/ruby-oauth/oauth2/graphs/tree.svg" alt="Coverage Graph"></a></p>
 
-See [CONTRIBUTING.md][🤝contributing].
+<p><a href="https://coveralls.io/github/ruby-oauth/oauth2?branch=main"><img src="https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main" alt="Coveralls Test Coverage"></a></p>
 
-### Code Coverage
+<p><a href="https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating"><img src="https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg" alt="QLTY Test Coverage"></a></p>
 
-[![Coverage Graph][🏀codecov-g]][🏀codecov]
+<h3 id="code-of-conduct">🪇 Code of Conduct</h3>
 
-[![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls]
+<p>Everyone interacting with this project’s codebases, issue trackers,
+chat rooms and mailing lists agrees to follow the <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg" alt="Contributor Covenant 2.1"></a>.</p>
 
-[![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov]
+<h2 id="contributors">🌈 Contributors</h2>
 
-### 🪇 Code of Conduct
+<p><a href="https://github.com/ruby-oauth/oauth2/graphs/contributors"><img src="https://contrib.rocks/image?repo=ruby-oauth/oauth2" alt="Contributors"></a></p>
 
-Everyone interacting with this project's codebases, issue trackers,
-chat rooms and mailing lists agrees to follow the [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct].
+<p>Made with <a href="https://contrib.rocks">contributors-img</a>.</p>
 
-## 🌈 Contributors
-
-[![Contributors][🖐contributors-img]][🖐contributors]
-
-Made with [contributors-img][🖐contrib-rocks].
-
-Also see GitLab Contributors: [https://gitlab.com/ruby-oauth/oauth2/-/graphs/main][🚎contributors-gl]
+<p>Also see GitLab Contributors: <a href="https://gitlab.com/ruby-oauth/oauth2/-/graphs/main">https://gitlab.com/ruby-oauth/oauth2/-/graphs/main</a></p>
 
 <details>
     <summary>⭐️ Star History</summary>
@@ -1427,55 +1580,58 @@ <h3 id="quick-examples">Quick Examples</h3>
 
 </details>
 
-## 📌 Versioning
+<h2 id="versioning">📌 Versioning</h2>
 
-This Library adheres to [![Semantic Versioning 2.0.0][📌semver-img]][📌semver].
+<p>This Library adheres to <a href="https://semver.org/spec/v2.0.0.html"><img src="https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat" alt="Semantic Versioning 2.0.0"></a>.
 Violations of this scheme should be reported as bugs.
 Specifically, if a minor or patch version is released that breaks backward compatibility,
 a new version should be immediately released that restores compatibility.
-Breaking changes to the public API will only be introduced with new major versions.
+Breaking changes to the public API will only be introduced with new major versions.</p>
 
-&gt; dropping support for a platform is both obviously and objectively a breaking change <br>
-&gt;—Jordan Harband ([@ljharb](https://github.com/ljharb), maintainer of SemVer) [in SemVer issue 716][📌semver-breaking]
+<blockquote>
+  <p>dropping support for a platform is both obviously and objectively a breaking change <br>
+—Jordan Harband (<a href="https://github.com/ljharb">@ljharb</a>, maintainer of SemVer) <a href="https://github.com/semver/semver/issues/716#issuecomment-869336139">in SemVer issue 716</a></p>
+</blockquote>
 
-I understand that policy doesn't work universally ("exceptions to every rule!"),
+<p>I understand that policy doesn’t work universally (“exceptions to every rule!”),
 but it is the policy here.
 As such, in many cases it is good to specify a dependency on this library using
-the [Pessimistic Version Constraint][📌pvc] with two digits of precision.
+the <a href="http://guides.rubygems.org/patterns/#pessimistic-version-constraint">Pessimistic Version Constraint</a> with two digits of precision.</p>
 
-For example:
+<p>For example:</p>
 
-```ruby
+<p><code>ruby
 spec.add_dependency("oauth2", "~&gt; 2.0")
-```
+</code></p>
 
 <details>
-<summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
+  <summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
 
-SemVer should, IMO, but doesn't explicitly, say that dropping support for specific Platforms
-is a *breaking change* to an API.
-It is obvious to many, but not all, and since the spec is silent, the bike shedding is endless.
+  <p>SemVer should, IMO, but doesn’t explicitly, say that dropping support for specific Platforms
+is a <em>breaking change</em> to an API, and for that reason the bike shedding is endless.</p>
 
-To get a better understanding of how SemVer is intended to work over a project's lifetime,
-read this article from the creator of SemVer:
+  <p>To get a better understanding of how SemVer is intended to work over a project’s lifetime,
+read this article from the creator of SemVer:</p>
 
-- ["Major Version Numbers are Not Sacred"][📌major-versions-not-sacred]
+  <ul>
+    <li><a href="https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html">“Major Version Numbers are Not Sacred”</a></li>
+  </ul>
 
 </details>
 
-See [CHANGELOG.md][📌changelog] for a list of releases.
+<p>See <a href="CHANGELOG.md">CHANGELOG.md</a> for a list of releases.</p>
 
-## 📄 License
+<h2 id="license">📄 License</h2>
 
-The gem is available as open source under the terms of
-the [MIT License][📄license] [![License: MIT][📄license-img]][📄license-ref].
-See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright-notice-explainer].
+<p>The gem is available as open source under the terms of
+the <a href="LICENSE.txt">MIT License</a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-259D6C.svg" alt="License: MIT"></a>.
+See <a href="LICENSE.txt">LICENSE.txt</a> for the official <a href="https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year">Copyright Notice</a>.</p>
 
-### © Copyright
+<h3 id="copyright">© Copyright</h3>
 
 <ul>
     <li>
-        Copyright (c) 2017–2025 Peter H. Boling, of
+        Copyright (c) 2017 – 2025 Peter H. Boling, of
         <a href="https://discord.gg/3qme4XHNKN">
             Galtzo.com
             <picture>
@@ -1484,243 +1640,30 @@ <h3 id="quick-examples">Quick Examples</h3>
         </a>, and oauth2 contributors.
     </li>
     <li>
-        Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.
+        Copyright (c) 2011 - 2013 Michael Bleigh and Intridea, Inc.
     </li>
 </ul>
 
-## 🤑 A request for help
+<h2 id="a-request-for-help">🤑 A request for help</h2>
 
-Maintainers have teeth and need to pay their dentists.
-After getting laid off in an RIF in March and filled with many dozens of rejections,
-I'm now spending ~60+ hours a week building open source tools.
-I'm hoping to be able to pay for my kids' health insurance this month,
+<p>Maintainers have teeth and need to pay their dentists.
+After getting laid off in an RIF in March, and encountering difficulty finding a new one,
+I began spending most of my time building open source tools.
+I’m hoping to be able to pay for my kids’ health insurance this month,
 so if you value the work I am doing, I need your support.
-Please consider sponsoring me or the project.
-
-To join the community or get help 👇️ Join the Discord.
-
-[![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
-
-To say "thanks!" ☝️ Join the Discord or 👇️ send money.
-
-[![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay-img] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal-img]
-
-### Please give the project a star ⭐ ♥.
-
-Thanks for RTFM. ☺️
-
-[⛳liberapay-img]: https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&amp;color=a51611&amp;style=flat
-[⛳liberapay-bottom-img]: https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&amp;logo=liberapay&amp;color=a51611
-[⛳liberapay]: https://liberapay.com/pboling/donate
-[🖇osc-all-img]: https://img.shields.io/opencollective/all/ruby-oauth
-[🖇osc-sponsors-img]: https://img.shields.io/opencollective/sponsors/ruby-oauth
-[🖇osc-backers-img]: https://img.shields.io/opencollective/backers/ruby-oauth
-[🖇osc-backers]: https://opencollective.com/ruby-oauth#backer
-[🖇osc-backers-i]: https://opencollective.com/ruby-oauth/backers/badge.svg?style=flat
-[🖇osc-sponsors]: https://opencollective.com/ruby-oauth#sponsor
-[🖇osc-sponsors-i]: https://opencollective.com/ruby-oauth/sponsors/badge.svg?style=flat
-[🖇osc-all-bottom-img]: https://img.shields.io/opencollective/all/ruby-oauth?style=for-the-badge
-[🖇osc-sponsors-bottom-img]: https://img.shields.io/opencollective/sponsors/ruby-oauth?style=for-the-badge
-[🖇osc-backers-bottom-img]: https://img.shields.io/opencollective/backers/ruby-oauth?style=for-the-badge
-[🖇osc]: https://opencollective.com/ruby-oauth
-[🖇sponsor-img]: https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&amp;logo=github
-[🖇sponsor-bottom-img]: https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&amp;logo=github
-[🖇sponsor]: https://github.com/sponsors/pboling
-[🖇polar-img]: https://img.shields.io/badge/polar-donate-a51611.svg?style=flat
-[🖇polar]: https://polar.sh/pboling
-[🖇kofi-img]: https://img.shields.io/badge/ko--fi-%E2%9C%93-a51611.svg?style=flat
-[🖇kofi]: https://ko-fi.com/O5O86SNP4
-[🖇patreon-img]: https://img.shields.io/badge/patreon-donate-a51611.svg?style=flat
-[🖇patreon]: https://patreon.com/galtzo
-[🖇buyme-small-img]: https://img.shields.io/badge/buy_me_a_coffee-%E2%9C%93-a51611.svg?style=flat
-[🖇buyme-img]: https://img.buymeacoffee.com/button-api/?text=Buy%20me%20a%20latte&amp;emoji=&amp;slug=pboling&amp;button_colour=FFDD00&amp;font_colour=000000&amp;font_family=Cookie&amp;outline_colour=000000&amp;coffee_colour=ffffff
-[🖇buyme]: https://www.buymeacoffee.com/pboling
-[🖇paypal-img]: https://img.shields.io/badge/donate-paypal-a51611.svg?style=flat&amp;logo=paypal
-[🖇paypal-bottom-img]: https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&amp;logo=paypal&amp;color=0A0A0A
-[🖇paypal]: https://www.paypal.com/paypalme/peterboling
-[🖇floss-funding.dev]: https://floss-funding.dev
-[🖇floss-funding-gem]: https://github.com/galtzo-floss/floss_funding
-[✉️discord-invite]: https://discord.gg/3qme4XHNKN
-[✉️discord-invite-img-ftb]: https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord
-[✉️ruby-friends-img]: https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&amp;logo=dailydotdev&amp;logoColor=white
-[✉️ruby-friends]: https://app.daily.dev/squads/rubyfriends
-
-[⛳gg-discussions]: https://groups.google.com/g/oauth-ruby
-[⛳gg-discussions-img]: https://img.shields.io/badge/google-group-0093D0.svg?style=for-the-badge&amp;logo=google&amp;logoColor=orange
-
-[✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
-[⛳️gem-namespace]: https://github.com/ruby-oauth/oauth2
-[⛳️namespace-img]: https://img.shields.io/badge/namespace-OAuth2-3C2D2D.svg?style=square&amp;logo=ruby&amp;logoColor=white
-[⛳️gem-name]: https://rubygems.org/gems/oauth2
-[⛳️name-img]: https://img.shields.io/badge/name-oauth2-3C2D2D.svg?style=square&amp;logo=rubygems&amp;logoColor=red
-[⛳️tag-img]: https://img.shields.io/github/tag/ruby-oauth/oauth2.svg
-[⛳️tag]: http://github.com/ruby-oauth/oauth2/releases
-[🚂maint-blog]: http://www.railsbling.com/tags/oauth2
-[🚂maint-blog-img]: https://img.shields.io/badge/blog-railsbling-0093D0.svg?style=for-the-badge&amp;logo=rubyonrails&amp;logoColor=orange
-[🚂maint-contact]: http://www.railsbling.com/contact
-[🚂maint-contact-img]: https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&amp;logo=rubyonrails&amp;logoColor=red
-[💖🖇linkedin]: http://www.linkedin.com/in/peterboling
-[💖🖇linkedin-img]: https://img.shields.io/badge/PeterBoling-LinkedIn-0B66C2?style=flat&amp;logo=newjapanprowrestling
-[💖✌️wellfound]: https://wellfound.com/u/peter-boling
-[💖✌️wellfound-img]: https://img.shields.io/badge/peter--boling-orange?style=flat&amp;logo=wellfound
-[💖💲crunchbase]: https://www.crunchbase.com/person/peter-boling
-[💖💲crunchbase-img]: https://img.shields.io/badge/peter--boling-purple?style=flat&amp;logo=crunchbase
-[💖🐘ruby-mast]: https://ruby.social/@galtzo
-[💖🐘ruby-mast-img]: https://img.shields.io/mastodon/follow/109447111526622197?domain=https://ruby.social&amp;style=flat&amp;logo=mastodon&amp;label=Ruby%20@galtzo
-[💖🦋bluesky]: https://bsky.app/profile/galtzo.com
-[💖🦋bluesky-img]: https://img.shields.io/badge/@galtzo.com-0285FF?style=flat&amp;logo=bluesky&amp;logoColor=white
-[💖🌳linktree]: https://linktr.ee/galtzo
-[💖🌳linktree-img]: https://img.shields.io/badge/galtzo-purple?style=flat&amp;logo=linktree
-[💖💁🏼‍♂️devto]: https://dev.to/galtzo
-[💖💁🏼‍♂️devto-img]: https://img.shields.io/badge/dev.to-0A0A0A?style=flat&amp;logo=devdotto&amp;logoColor=white
-[💖💁🏼‍♂️aboutme]: https://about.me/peter.boling
-[💖💁🏼‍♂️aboutme-img]: https://img.shields.io/badge/about.me-0A0A0A?style=flat&amp;logo=aboutme&amp;logoColor=white
-[💖🧊berg]: https://codeberg.org/pboling
-[💖🐙hub]: https://github.org/pboling
-[💖🛖hut]: https://sr.ht/~galtzo/
-[💖🧪lab]: https://gitlab.com/pboling
-[👨🏼‍🏫expsup-upwork]: https://www.upwork.com/freelancers/~014942e9b056abdf86?mp_source=share
-[👨🏼‍🏫expsup-upwork-img]: https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&amp;logo=Upwork&amp;logoColor=white
-[👨🏼‍🏫expsup-codementor]: https://www.codementor.io/peterboling?utm_source=github&amp;utm_medium=button&amp;utm_term=peterboling&amp;utm_campaign=github
-[👨🏼‍🏫expsup-codementor-img]: https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&amp;logo=CodeMentor&amp;logoColor=white
-[🏙️entsup-tidelift]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&amp;utm_medium=referral&amp;utm_campaign=readme
-[🏙️entsup-tidelift-img]: https://img.shields.io/badge/Tidelift_and_Sonar-Enterprise_Support-FD3456?style=for-the-badge&amp;logo=sonar&amp;logoColor=white
-[🏙️entsup-tidelift-sonar]: https://blog.tidelift.com/tidelift-joins-sonar
-[💁🏼‍♂️peterboling]: http://www.peterboling.com
-[🚂railsbling]: http://www.railsbling.com
-[📜src-gl-img]: https://img.shields.io/badge/GitLab-FBA326?style=for-the-badge&amp;logo=Gitlab&amp;logoColor=orange
-[📜src-gl]: https://gitlab.com/ruby-oauth/oauth2/
-[📜src-cb-img]: https://img.shields.io/badge/CodeBerg-4893CC?style=for-the-badge&amp;logo=CodeBerg&amp;logoColor=blue
-[📜src-cb]: https://codeberg.org/ruby-oauth/oauth2
-[📜src-gh-img]: https://img.shields.io/badge/GitHub-238636?style=for-the-badge&amp;logo=Github&amp;logoColor=green
-[📜src-gh]: https://github.com/ruby-oauth/oauth2
-[📜docs-cr-rd-img]: https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white
-[📜docs-head-rd-img]: https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&amp;logo=readthedocs&amp;logoColor=white
-[📜gl-wiki]: https://gitlab.com/ruby-oauth/oauth2/-/wikis/home
-[📜gh-wiki]: https://github.com/ruby-oauth/oauth2/wiki
-[📜gl-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=gitlab&amp;logoColor=white
-[📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&amp;logo=github&amp;logoColor=white
-[👽dl-rank]: https://rubygems.org/gems/oauth2
-[👽dl-ranki]: https://img.shields.io/gem/rd/oauth2.svg
-[👽oss-help]: https://www.codetriage.com/ruby-oauth/oauth2
-[👽oss-helpi]: https://www.codetriage.com/ruby-oauth/oauth2/badges/users.svg
-[👽version]: https://rubygems.org/gems/oauth2
-[👽versioni]: https://img.shields.io/gem/v/oauth2.svg
-[🏀qlty-mnt]: https://qlty.sh/gh/ruby-oauth/projects/oauth2
-[🏀qlty-mnti]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg
-[🏀qlty-cov]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating
-[🏀qlty-covi]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg
-[🏀codecov]: https://codecov.io/gh/ruby-oauth/oauth2
-[🏀codecovi]: https://codecov.io/gh/ruby-oauth/oauth2/graph/badge.svg
-[🏀coveralls]: https://coveralls.io/github/ruby-oauth/oauth2?branch=main
-[🏀coveralls-img]: https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main
-[🖐codeQL]: https://github.com/ruby-oauth/oauth2/security/code-scanning
-[🖐codeQL-img]: https://github.com/ruby-oauth/oauth2/actions/workflows/codeql-analysis.yml/badge.svg
-[🚎1-an-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml
-[🚎1-an-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml/badge.svg
-[🚎2-cov-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml
-[🚎2-cov-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/coverage.yml/badge.svg
-[🚎3-hd-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml
-[🚎3-hd-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/heads.yml/badge.svg
-[🚎4-lg-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml
-[🚎4-lg-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/legacy.yml/badge.svg
-[🚎5-st-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml
-[🚎5-st-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/style.yml/badge.svg
-[🚎6-s-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml
-[🚎6-s-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/supported.yml/badge.svg
-[🚎7-us-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml
-[🚎7-us-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml/badge.svg
-[🚎8-ho-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml
-[🚎8-ho-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml/badge.svg
-[🚎9-t-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml
-[🚎9-t-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml/badge.svg
-[🚎10-j-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml
-[🚎10-j-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml/badge.svg
-[🚎11-c-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml
-[🚎11-c-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml/badge.svg
-[🚎12-crh-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml
-[🚎12-crh-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/dep-heads.yml/badge.svg
-[🚎13-cbs-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/caboose.yml
-[🚎13-cbs-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/caboose.yml/badge.svg
-[🚎13-🔒️-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml
-[🚎13-🔒️-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/locked_deps.yml/badge.svg
-[🚎14-🔓️-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml
-[🚎14-🔓️-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/unlocked_deps.yml/badge.svg
-[🚎15-🪪-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml
-[🚎15-🪪-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/license-eye.yml/badge.svg
-[💎ruby-2.2i]: https://img.shields.io/badge/Ruby-2.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.3i]: https://img.shields.io/badge/Ruby-2.3-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.4i]: https://img.shields.io/badge/Ruby-2.4-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.5i]: https://img.shields.io/badge/Ruby-2.5-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.6i]: https://img.shields.io/badge/Ruby-2.6-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-2.7i]: https://img.shields.io/badge/Ruby-2.7-DF00CA?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.0i]: https://img.shields.io/badge/Ruby-3.0-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.1i]: https://img.shields.io/badge/Ruby-3.1-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.2i]: https://img.shields.io/badge/Ruby-3.2-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-3.3i]: https://img.shields.io/badge/Ruby-3.3-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=white
-[💎ruby-c-i]: https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=green
-[💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue
-[💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink
-[💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink
-[💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=pink
-[💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=green
-[💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue
-[💎jruby-9.1i]: https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-9.2i]: https://img.shields.io/badge/JRuby-9.2_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-9.3i]: https://img.shields.io/badge/JRuby-9.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-9.4i]: https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=red
-[💎jruby-c-i]: https://img.shields.io/badge/JRuby-current-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=green
-[💎jruby-headi]: https://img.shields.io/badge/JRuby-HEAD-FBE742?style=for-the-badge&amp;logo=ruby&amp;logoColor=blue
-[🤝gh-issues]: https://github.com/ruby-oauth/oauth2/issues
-[🤝gh-pulls]: https://github.com/ruby-oauth/oauth2/pulls
-[🤝gl-issues]: https://gitlab.com/ruby-oauth/oauth2/-/issues
-[🤝gl-pulls]: https://gitlab.com/ruby-oauth/oauth2/-/merge_requests
-[🤝cb-issues]: https://codeberg.org/ruby-oauth/oauth2/issues
-[🤝cb-pulls]: https://codeberg.org/ruby-oauth/oauth2/pulls
-[🤝cb-donate]: https://donate.codeberg.org/
-[🤝contributing]: CONTRIBUTING.md
-[🏀codecov-g]: https://codecov.io/gh/ruby-oauth/oauth2/graphs/tree.svg
-[🖐contrib-rocks]: https://contrib.rocks
-[🖐contributors]: https://github.com/ruby-oauth/oauth2/graphs/contributors
-[🖐contributors-img]: https://contrib.rocks/image?repo=ruby-oauth/oauth2
-[🚎contributors-gl]: https://gitlab.com/ruby-oauth/oauth2/-/graphs/main
-[🪇conduct]: CODE_OF_CONDUCT.md
-[🪇conduct-img]: https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg
-[📌pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
-[📌semver]: https://semver.org/spec/v2.0.0.html
-[📌semver-img]: https://img.shields.io/badge/semver-2.0.0-259D6C.svg?style=flat
-[📌semver-breaking]: https://github.com/semver/semver/issues/716#issuecomment-869336139
-[📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
-[📌changelog]: CHANGELOG.md
-[📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
-[📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat
-[📌gitmoji]:https://gitmoji.dev
-[📌gitmoji-img]:https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
-[🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&amp;logo=YouTube&amp;logoColor=blue
-[🔐security]: SECURITY.md
-[🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
-[🔐irp]: IRP.md
-[🔐irp-img]: https://img.shields.io/badge/IRP-259D6C.svg?style=flat
-[🔐threat-model]: THREAT_MODEL.md
-[🔐threat-model-img]: https://img.shields.io/badge/threat-model-259D6C.svg?style=flat
-[📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
-[📄license]: LICENSE.txt
-[📄license-ref]: https://opensource.org/licenses/MIT
-[📄license-img]: https://img.shields.io/badge/License-MIT-259D6C.svg
-[📄license-compat]: https://dev.to/galtzo/how-to-check-license-compatibility-41h0
-[📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&amp;logo=Apache
-[📄ilo-declaration]: https://www.ilo.org/declaration/lang--en/index.htm
-[📄ilo-declaration-img]: https://img.shields.io/badge/ILO_Fundamental_Principles-✓-259D6C.svg?style=flat
-[🚎yard-current]: http://rubydoc.info/gems/oauth2
-[🚎yard-head]: https://oauth2.galtzo.com
-[💎stone_checksums]: https://github.com/galtzo-floss/stone_checksums
-[💎SHA_checksums]: https://gitlab.com/ruby-oauth/oauth2/-/tree/main/checksums
-[💎rlts]: https://github.com/rubocop-lts/rubocop-lts
-[💎rlts-img]: https://img.shields.io/badge/code_style_&amp;_linting-rubocop--lts-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white
-[💎appraisal2]: https://github.com/appraisal-rb/appraisal2
-[💎appraisal2-img]: https://img.shields.io/badge/appraised_by-appraisal2-34495e.svg?plastic&amp;logo=ruby&amp;logoColor=white
-[💎d-in-dvcs]: https://railsbling.com/posts/dvcs/put_the_d_in_dvcs/
+Please consider sponsoring me or the project.</p>
+
+<p>To join the community or get help 👇️ Join the Discord.</p>
+
+<p><a href="https://discord.gg/3qme4XHNKN"><img src="https://img.shields.io/discord/1373797679469170758?style=for-the-badge&amp;logo=discord" alt="Live Chat on Discord"></a></p>
+
+<p>To say “thanks!” ☝️ Join the Discord or 👇️ send money.</p>
+
+<p><a href="https://opencollective.com/ruby-oauth"><img src="https://img.shields.io/opencollective/all/ruby-oauth?style=for-the-badge" alt="Sponsor ruby-oauth/oauth2 on Open Source Collective"></a> 💌 <a href="https://github.com/sponsors/pboling"><img src="https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&amp;logo=github" alt="Sponsor me on GitHub Sponsors"></a> 💌 <a href="https://liberapay.com/pboling/donate"><img src="https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&amp;logo=liberapay&amp;color=a51611" alt="Sponsor me on Liberapay"></a> 💌 <a href="https://www.paypal.com/paypalme/peterboling"><img src="https://img.shields.io/badge/donate-paypal-a51611.svg?style=for-the-badge&amp;logo=paypal&amp;color=0A0A0A" alt="Donate on PayPal"></a></p>
+
+<h3 id="please-give-the-project-a-star--">Please give the project a star ⭐ ♥.</h3>
+
+<p>Thanks for RTFM. ☺️</p>
 
 <details>
   <summary>
@@ -1731,13 +1674,12 @@ <h3 id="quick-examples">Quick Examples</h3>
 <a rel="me" alt="Follow me on FLOSS.social" href="https://floss.social/@galtzo"><img src="https://img.shields.io/mastodon/follow/110304921404405715?domain=https://floss.social&amp;style=social&amp;label=Follow%20@galtzo%20on%20Floss.social"></a>
 
 </details>
-</token></realm></realm></details>
 </div></div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:13 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/docs/top-level-namespace.html b/docs/top-level-namespace.html
index 0040754f..ba975a96 100644
--- a/docs/top-level-namespace.html
+++ b/docs/top-level-namespace.html
@@ -100,9 +100,9 @@ <h2>Defined Under Namespace</h2>
 </div>
 
       <div id="footer">
-  Generated on Thu Sep 25 11:50:27 2025 by
+  Generated on Fri Nov  7 20:38:14 2025 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.37 (ruby-3.4.5).
+  0.9.37 (ruby-3.4.7).
 </div>
 
     </div>
diff --git a/gemfiles/modular/documentation.gemfile b/gemfiles/modular/documentation.gemfile
index 78533908..47f1a9d3 100644
--- a/gemfiles/modular/documentation.gemfile
+++ b/gemfiles/modular/documentation.gemfile
@@ -9,3 +9,4 @@ gem "yard-relative_markdown_links", "~> 0.5.0"
 
 # Std Lib extractions
 gem "rdoc", "~> 6.11"
+gem "yard-fence", "~> 0.4", require: false # Ruby >= 3.2
diff --git a/gemfiles/modular/erb/r2.3/default.gemfile b/gemfiles/modular/erb/r2.3/default.gemfile
index a38f952f..ca868e84 100644
--- a/gemfiles/modular/erb/r2.3/default.gemfile
+++ b/gemfiles/modular/erb/r2.3/default.gemfile
@@ -1,5 +1,5 @@
 # The cake is a lie.
-# erb v2.2, the oldest release on RubyGems.org, was never compatible with Ruby 2.3.
+# erb v2.2, the oldest release, was never compatible with Ruby 2.3.
 # In addition, erb does not follow SemVer, and old rubies get dropped in a patch.
 # This means we have no choice but to use the erb that shipped with Ruby 2.3
 # /opt/hostedtoolcache/Ruby/2.3.8/x64/lib/ruby/gems/2.3.0/gems/erb-2.2.2/lib/erb.rb:670:in `prepare_trim_mode': undefined method `match?' for "-":String (NoMethodError)
diff --git a/gemfiles/modular/optional.gemfile b/gemfiles/modular/optional.gemfile
index dae6a950..2eda51c6 100644
--- a/gemfiles/modular/optional.gemfile
+++ b/gemfiles/modular/optional.gemfile
@@ -1 +1,2 @@
 # Optional dependencies are not depended on directly, but may be used if present.
+gem "addressable", ">= 2.8", "< 3" # ruby >= 2.2
diff --git a/lib/oauth2/access_token.rb b/lib/oauth2/access_token.rb
index c428c019..8c68e321 100644
--- a/lib/oauth2/access_token.rb
+++ b/lib/oauth2/access_token.rb
@@ -134,7 +134,7 @@ def no_tokens_warning(hash, key)
     # @option opts [FixNum, String] :expires_latency (nil) the number of seconds by which AccessToken validity will be reduced to offset latency, @version 2.0+
     # @option opts [Symbol, Hash, or callable] :mode (:header) the transmission mode of the Access Token parameter value:
     #    either one of :header, :body or :query; or a Hash with verb symbols as keys mapping to one of these symbols
-    #    (e.g., {get: :query, post: :header, delete: :header}); or a callable that accepts a request-verb parameter
+    #    (e.g., `{get: :query, post: :header, delete: :header}`); or a callable that accepts a request-verb parameter
     #    and returns one of these three symbols.
     # @option opts [String] :header_format ('Bearer %s') the string format to use for the Authorization header
     #
diff --git a/lib/oauth2/strategy/assertion.rb b/lib/oauth2/strategy/assertion.rb
index 6396fd6d..0515b26b 100644
--- a/lib/oauth2/strategy/assertion.rb
+++ b/lib/oauth2/strategy/assertion.rb
@@ -66,8 +66,8 @@ def authorize_url
       #   @see https://datatracker.ietf.org/doc/html/rfc7518#section-3.1
       #
       # The object type of `:key` may depend on the value of `:algorithm`.  Sample arguments:
-      #   get_token(claim_set, {:algorithm => 'HS256', :key => 'secret_key'})
-      #   get_token(claim_set, {:algorithm => 'RS256', :key => OpenSSL::PKCS12.new(File.read('my_key.p12'), 'not_secret')})
+      #   `get_token(claim_set, {:algorithm => 'HS256', :key => 'secret_key'})`
+      #   `get_token(claim_set, {:algorithm => 'RS256', :key => OpenSSL::PKCS12.new(File.read('my_key.p12'), 'not_secret')})`
       #
       # @param [Hash] request_opts options that will be used to assemble the request
       # @option request_opts [String] :scope the url parameter `scope` that may be required by some endpoints
diff --git a/oauth2.gemspec b/oauth2.gemspec
index 0556ea5c..a1d34e52 100644
--- a/oauth2.gemspec
+++ b/oauth2.gemspec
@@ -43,7 +43,6 @@ Gem::Specification.new do |spec|
   end
 
   gl_homepage = "https://gitlab.com/ruby-oauth/#{spec.name}"
-  gh_mirror = spec.homepage
 
   spec.post_install_message = %{
 ---+++--- oauth2 v#{gem_version} ---+++---
@@ -73,9 +72,9 @@ Thanks, @pboling / @galtzo
 }
 
   spec.metadata["homepage_uri"] = "https://#{spec.name.tr("_", "-")}.galtzo.com/"
-  spec.metadata["source_code_uri"] = "#{gh_mirror}/tree/v#{spec.version}"
-  spec.metadata["changelog_uri"] = "#{gh_mirror}/blob/v#{spec.version}/CHANGELOG.md"
-  spec.metadata["bug_tracker_uri"] = "#{gh_mirror}/issues"
+  spec.metadata["source_code_uri"] = "#{spec.homepage}/tree/v#{spec.version}"
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/v#{spec.version}/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
   spec.metadata["documentation_uri"] = "https://www.rubydoc.info/gems/#{spec.name}/#{spec.version}"
   spec.metadata["mailing_list_uri"] = "https://groups.google.com/g/oauth-ruby"
   spec.metadata["funding_uri"] = "https://github.com/sponsors/pboling"
@@ -86,8 +85,7 @@ Thanks, @pboling / @galtzo
 
   # Specify which files are part of the released package.
   spec.files = Dir[
-    # Executables and tasks
-    "exe/*",
+    # Code / tasks / data (NOTE: exe/ is specified via spec.bindir and spec.executables below)
     "lib/**/*.rb",
     "lib/**/*.rake",
     # Signatures
@@ -109,6 +107,7 @@ Thanks, @pboling / @galtzo
     "REEK",
     "RUBOCOP.md",
     "SECURITY.md",
+    "THREAT_MODEL.md",
   ]
   spec.rdoc_options += [
     "--title",
@@ -136,7 +135,7 @@ Thanks, @pboling / @galtzo
   spec.add_dependency("version_gem", "~> 1.1", ">= 1.1.9")  # ruby >= 2.2.0
 
   # NOTE: It is preferable to list development dependencies in the gemspec due to increased
-  #       visibility and discoverability on RubyGems.org.
+  #       visibility and discoverability.
   #       However, development dependencies in gemspec will install on
   #       all versions of Ruby that will run in CI.
   #       This gem, and its gemspec runtime dependencies, will install on Ruby down to 2.2.0.
@@ -153,7 +152,7 @@ Thanks, @pboling / @galtzo
   spec.add_development_dependency("rexml", "~> 3.2", ">= 3.2.5")        # ruby >= 0
 
   # Dev, Test, & Release Tasks
-  spec.add_development_dependency("kettle-dev", "~> 1.1")                     # ruby >= 2.3.0
+  spec.add_development_dependency("kettle-dev", "~> 1.1")                           # ruby >= 2.3.0
 
   # Security
   spec.add_development_dependency("bundler-audit", "~> 0.9.2")                      # ruby >= 2.0.0
@@ -166,8 +165,7 @@ Thanks, @pboling / @galtzo
 
   # Testing
   spec.add_development_dependency("appraisal2", "~> 3.0")                           # ruby >= 1.8.7, for testing against multiple versions of dependencies
-  spec.add_development_dependency("kettle-test", "~> 1.0")                          # ruby >= 2.3
-  spec.add_development_dependency("rspec-pending_for", "~> 0.0", ">= 0.0.17")       # ruby >= 2.3, used to skip specs on incompatible Rubies
+  spec.add_development_dependency("kettle-test", "~> 1.0", ">= 1.0.6")              # ruby >= 2.3
 
   # Releasing
   spec.add_development_dependency("ruby-progressbar", "~> 1.13")                    # ruby >= 0
@@ -179,7 +177,7 @@ Thanks, @pboling / @galtzo
   # spec.add_dependency("git", ">= 1.19.1")                               # ruby >= 2.3
 
   # Development tasks
-  # The cake is a lie. erb v2.2, the oldest release on RubyGems.org, was never compatible with Ruby 2.3.
+  # The cake is a lie. erb v2.2, the oldest release, was never compatible with Ruby 2.3.
   # This means we have no choice but to use the erb that shipped with Ruby 2.3
   # /opt/hostedtoolcache/Ruby/2.3.8/x64/lib/ruby/gems/2.3.0/gems/erb-2.2.2/lib/erb.rb:670:in `prepare_trim_mode': undefined method `match?' for "-":String (NoMethodError)
   # spec.add_development_dependency("erb", ">= 2.2")                                  # ruby >= 2.3.0, not SemVer, old rubies get dropped in a patch.
@@ -201,6 +199,6 @@ Thanks, @pboling / @galtzo
   # In Ruby 3.5 (HEAD) the CGI library has been pared down, so we also need to depend on gem "cgi" for ruby@head
   # This is done in the "head" appraisal.
   # See: https://github.com/vcr/vcr/issues/1057
-  spec.add_development_dependency("vcr", ">= 4")                        # 6.0 claims to support ruby >= 2.3, but fails on ruby 2.4
-  spec.add_development_dependency("webmock", ">= 3")                    # Last version to support ruby >= 2.3
+  # spec.add_development_dependency("vcr", ">= 4")                        # 6.0 claims to support ruby >= 2.3, but fails on ruby 2.4
+  # spec.add_development_dependency("webmock", ">= 3")                    # Last version to support ruby >= 2.3
 end