diff --git a/openapi/oauth/client_test.go b/openapi/oauth/client_test.go
index 1db9048e..9093018a 100644
--- a/openapi/oauth/client_test.go
+++ b/openapi/oauth/client_test.go
@@ -367,6 +367,45 @@ func TestDynamicClientRegistration(t *testing.T) {
 		assert.Equal(t, types.ErrorInvalidRequest, oauthErr.Code)
 		assert.Contains(t, oauthErr.ErrorDescription, "At least one redirect URI is required")
 	})
+
+	t.Run("register with disallowed redirect URI host", func(t *testing.T) {
+		request := &types.DynamicClientRegistrationRequest{
+			ClientName:   "Disallowed Host Client",
+			RedirectURIs: []string{"https://example.com/callback"}, // example.com is not in allowed hosts
+		}
+
+		response, err := service.DynamicClientRegistration(ctx, request)
+		assert.Error(t, err)
+		assert.Nil(t, response)
+
+		oauthErr, ok := err.(*types.ErrorResponse)
+		assert.True(t, ok)
+		assert.Equal(t, types.ErrorInvalidRequest, oauthErr.Code)
+		assert.Contains(t, oauthErr.ErrorDescription, "Redirect URI host 'example.com' is not allowed")
+	})
+
+	t.Run("register with disallowed redirect URI scheme", func(t *testing.T) {
+		// Temporarily restrict schemes to only HTTPS
+		originalSchemes := service.config.Client.AllowedRedirectURISchemes
+		service.config.Client.AllowedRedirectURISchemes = []string{"https"}
+		defer func() {
+			service.config.Client.AllowedRedirectURISchemes = originalSchemes
+		}()
+
+		request := &types.DynamicClientRegistrationRequest{
+			ClientName:   "Disallowed Scheme Client",
+			RedirectURIs: []string{"http://localhost/callback"}, // HTTP is not allowed when only HTTPS is permitted
+		}
+
+		response, err := service.DynamicClientRegistration(ctx, request)
+		assert.Error(t, err)
+		assert.Nil(t, response)
+
+		oauthErr, ok := err.(*types.ErrorResponse)
+		assert.True(t, ok)
+		assert.Equal(t, types.ErrorInvalidRequest, oauthErr.Code)
+		assert.Contains(t, oauthErr.ErrorDescription, "Redirect URI scheme 'http' is not allowed")
+	})
 }
 
 // =============================================================================
diff --git a/openapi/oauth/oauth_test.go b/openapi/oauth/oauth_test.go
index 34853c45..3152f6f9 100644
--- a/openapi/oauth/oauth_test.go
+++ b/openapi/oauth/oauth_test.go
@@ -83,7 +83,7 @@ var testClients = []*TestClient{
 		ClientSecret:  "confidential-secret-12345",
 		ClientName:    "Test Confidential Client",
 		ClientType:    types.ClientTypeConfidential,
-		RedirectURIs:  []string{"https://confidential.example.com/callback"},
+		RedirectURIs:  []string{"https://localhost/callback"},
 		GrantTypes:    []string{types.GrantTypeAuthorizationCode, types.GrantTypeRefreshToken},
 		ResponseTypes: []string{types.ResponseTypeCode},
 		Scope:         "openid profile email",
@@ -94,7 +94,7 @@ var testClients = []*TestClient{
 		ClientSecret:  "", // Public clients don't have secrets
 		ClientName:    "Test Public Client",
 		ClientType:    types.ClientTypePublic,
-		RedirectURIs:  []string{"https://public.example.com/callback"},
+		RedirectURIs:  []string{"https://localhost/callback"},
 		GrantTypes:    []string{types.GrantTypeAuthorizationCode},
 		ResponseTypes: []string{types.ResponseTypeCode},
 		Scope:         "openid profile",
@@ -105,7 +105,7 @@ var testClients = []*TestClient{
 		ClientSecret:  "credentials-secret-67890",
 		ClientName:    "Test Client Credentials Client",
 		ClientType:    types.ClientTypeConfidential,
-		RedirectURIs:  []string{"https://credentials.example.com/callback"},
+		RedirectURIs:  []string{"https://localhost/callback"},
 		GrantTypes:    []string{types.GrantTypeClientCredentials},
 		ResponseTypes: []string{types.ResponseTypeCode},
 		Scope:         "api:read api:write",