@@ -997,9 +997,9 @@ def exchange_refresh_token(as_metadata:, client_info:, refresh_token:, resource:
           post_to_token_endpoint(as_metadata: as_metadata, client_info: client_info, form: form)
         end
 
-        # Submits a form-encoded request to the token endpoint, applying
-        # the client authentication method advertised in `client_information` and
-        # adding `client_id` (and `client_secret` when not using HTTP Basic).
+        # Submits a form-encoded token request using the authentication method
+        # stored in `client_information`. The method determines whether client
+        # credentials belong in the form body, a Basic header, or a JWT assertion.
         def post_to_token_endpoint(as_metadata:, client_info:, form:)
           client_id = client_info_required_value(client_info, "client_id")
           unless client_id
@@ -1010,17 +1010,13 @@ def post_to_token_endpoint(as_metadata:, client_info:, form:)
           client_secret = client_info_required_value(client_info, "client_secret")
           token_endpoint_auth_method = client_info_value(client_info, "token_endpoint_auth_method")
 
-          # Each branch carries the client identity in exactly one place. Sending
-          # it twice reads as two client authentication methods to a strict
-          # authorization server (RFC 6749 Section 2.3), which rejects the request.
+          # Apply one client authentication method per request (RFC 6749 Section 2.3).
           headers = {}
           form = case token_endpoint_auth_method
           when "private_key_jwt"
-            # RFC 7523 Section 2.2 JWT client assertion for the `private_key_jwt` method of
-            # the `io.modelcontextprotocol/oauth-client-credentials` extension (SEP-1046).
-            # The client identity travels in the assertion's `iss`/`sub` claims, so `client_id` is
-            # omitted from the body per RFC 7521 Section 4.2 (the `client_assertion` conveys the client identity).
-            # The audience is the issuer identifier that `ensure_issuer_matches!` already byte-validated.
+            # The assertion identifies the client through its `iss` and `sub`
+            # claims, so the body needs no separate `client_id` (RFC 7521 Section 4.2).
+            # Use the issuer already checked by `ensure_issuer_matches!` as the audience.
             unless @provider.respond_to?(:client_assertion)
               raise AuthorizationError,
                 "token_endpoint_auth_method is private_key_jwt but the provider does not " \
@@ -1032,24 +1028,22 @@ def post_to_token_endpoint(as_metadata:, client_info:, form:)
               "client_assertion" => @provider.client_assertion(audience: as_metadata["issuer"]),
             )
           when "client_secret_post"
-            # RFC 6749 Section 2.3.1: both credentials travel in the request body.
+            # Send the client ID and available secret in the form body.
             body = form.merge("client_id" => client_id)
             body["client_secret"] = client_secret if client_secret
             body
           else
             if client_secret && token_endpoint_auth_method != "none"
-              # RFC 6749 Section 2.3.1 recommends Basic for confidential clients and
-              # both Python and TypeScript SDKs default here when
-              # the authentication method is not explicitly stored. The Basic username
-              # is already the client identifier, so a body `client_id` adds nothing;
-              # Section 3.2.1 makes it a MAY, and servers that read it as a second
-              # authentication method reject the request with `invalid_request`.
+              # Basic is also the fallback when a secret is present but no method
+              # is stored. A body `client_id` is optional (RFC 6749 Section 3.2.1);
+              # omit it because some servers treat it alongside Basic as a second
+              # authentication method and reject the request with `invalid_request`.
               headers["Authorization"] = "Basic " + basic_auth_credentials(client_id, client_secret)
               form
             else
-              # Public client, whether by an explicit `none` or the absence of a
-              # secret. `client_id` is the only thing identifying it, and the
-              # authorization_code grant requires it (RFC 6749 Section 3.2.1).
+              # With `none` or no secret, identify the client using `client_id`.
+              # This is required for unauthenticated authorization-code exchanges
+              # (RFC 6749 Section 3.2.1).
               form.merge("client_id" => client_id)
             end
           end
 
@@ -159,10 +159,8 @@ def test_run_client_credentials_with_client_secret_post_sends_credentials_in_bod
         end
 
         def test_run_client_credentials_with_client_secret_basic_omits_client_id_from_body
-          # With HTTP Basic the client identity already travels in the header,
-          # and RFC 6749 Section 3.2.1 makes a body `client_id` a MAY. Servers
-          # that read one as a second authentication method reject the whole
-          # request with `invalid_request`, so omit it.
+          # Explicit Basic authentication must keep both credentials in the header
+          # to avoid servers treating body credentials as a second auth method.
           provider = client_credentials_provider(token_endpoint_auth_method: "client_secret_basic")
 
           Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
@@ -1877,8 +1875,10 @@ def test_run_uses_basic_auth_when_token_endpoint_auth_method_is_client_secret_ba
 
           expected = "Basic " + Base64.strict_encode64("pre-registered-client:pre-registered-secret")
           assert_requested(:post, "#{@auth_base}/token") do |req|
+            form = URI.decode_www_form(req.body).to_h
             req.headers["Authorization"] == expected &&
-              !URI.decode_www_form(req.body).to_h.key?("client_secret")
+              !form.key?("client_id") &&
+              !form.key?("client_secret")
           end
         end
 
@@ -2383,10 +2383,8 @@ def test_refresh_swaps_refresh_token_for_new_access_token
         end
 
         def test_refresh_with_client_secret_basic_omits_client_id_from_body
-          # The authorization-code exchange is often hand-rolled by the host app,
-          # so refresh is where a double-authenticated request first reaches a
-          # strict authorization server -- roughly an access token's lifetime
-          # after the grant was created.
+          # Stored credentials without an auth method default to Basic. Refresh
+          # must also omit the body `client_id` when using that fallback.
           stub_request(:post, "#{@auth_base}/token")
             .with(body: hash_including("grant_type" => "refresh_token"))
             .to_return(
@@ -2409,7 +2407,8 @@ def test_refresh_with_client_secret_basic_omits_client_id_from_body
           assert_requested(:post, "#{@auth_base}/token") do |req|
             form = URI.decode_www_form(req.body).to_h
             req.headers["Authorization"] == "Basic " + Base64.strict_encode64("conf-client:conf-secret") &&
-              !form.key?("client_id")
+              !form.key?("client_id") &&
+              !form.key?("client_secret")
           end
         end