AdGuard validates client IDs as DNS labels: 'invalid clientid: bad hostname label rune'. base64url alphabet contains '_' which fails. Switch to hex (a-f, 0-9) — 32 bytes hex = 64 chars, 256-bit entropy, DNS-safe.
AdGuard validates client IDs as DNS labels: 'invalid clientid: bad hostname label rune'. base64url alphabet contains '_' which fails. Switch to hex (a-f, 0-9) — 32 bytes hex = 64 chars, 256-bit entropy, DNS-safe.