There is no issuer in OAuth. Therefore, the distinct-redirect-URI solution is the most universal.