OIDC Specifications: Authorization Code Grant Flow. As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.) In this scenario, Can Auth End Point and Token End Point can be of different servers? Client sends the Authorise request to Auth End Point - Server1 Client sends the Token request to Token End Point - Server 2 where Server 2 validates the auth code with Server 1 and respond by adding extra response data and send the token back to Client. Is this in-line with the specifications and are there any security concerns that can raised or has to be addressed.