Ask Asgardeo and Identity Server to seed a well-known wso2cli public client

Moved from the removed docs/research/product-authentication-compatibility.md §1.1 (full text in git history). Nothing tracked this ask before.

BACKEND GAP (owner: Asgardeo — wso2/identity-apps/service team; IS —
wso2/product-is): no WSO2-published, well-known public client for a CLI
exists in Asgardeo or IS; every tenant/deployment must register its own app.
Evidence of absence: no such client appears in the application guides or the
IS app-configuration references (landscape §§1–2). Until one ships, the
wso2-cli needs per-context client configuration or registration.

Standing ask, recorded 2026-08-05 — owner: the Asgardeo service team
(wso2/identity-apps), and wso2/product-is for Identity Server. The
wso2-cli login slice ships against this gap rather than waiting for it to
close: every tenant and every deployment registers its own public client by
hand, and the per-product login walkthroughs —
Asgardeo,
Identity Server,
ThunderID — are that manual
registration written out in full — a standard-based application, public client,
PKCE mandatory with S256, the four loopback callbacks
http://127.0.0.1:{10425,10426,10427,10428}/callback, the refresh-token grant,
and an API resource whose identifier becomes the audience.

The ask is a WSO2-seeded, well-known wso2cli public client, provisioned in
every Asgardeo organization and every Identity Server deployment with exactly
that shape. What it buys is specific and measurable: the walkthrough's entire
registration half (§§2–3, two of its nine sections) collapses to a default
clientId the shell ships, clientId stops being a field a first-time user has
to supply in the context document, and the only value that user still provides
is the issuer. Until it ships, those sections stay, and every reported
auth.discovery_failed or redirect-mismatch from a hand-registered application
is a cost attributable to this gap.

Prior art

ThunderID/Agent Manager already seed a public client for their CLI: amctl ships a default client ID amctl for the interactive browser flow (amctl login reference).

Done when

• Asgardeo and Identity Server provision a well-known wso2cli public client (PKCE, loopback redirect, device code where supported).
• The shell ships it as the default clientId, and the per-product setup guides drop their app-registration steps.

Start by reviewing the wso2-cli login slice and its Asgardeo, Identity Server, and ThunderID walkthroughs, then coordinate with the referenced identity-apps and product-is teams. Confirm how the seeded wso2cli public client and default clientId should be represented. Done means both products provision the client and the guides no longer require manual app registration.