@@ -1010,6 +1010,7 @@ func (c *Client) handleOAuthAuthorization(ctx context.Context, authErr error, oa
 
 	// Determine OAuth mode and attempt registration if needed
 	var oauthMode string
+	var dcrErr error
 	if hasStaticCredentials {
 		// Skip DCR when static credentials are provided in config
 		oauthMode = "static credentials"
@@ -1040,7 +1041,9 @@ func (c *Client) handleOAuthAuthorization(ctx context.Context, authErr error, oa
 		}()
 
 		if regErr != nil {
-			// DCR failed - proceed with public client OAuth (PKCE without client_id)
+			// DCR failed - proceed and let the empty-client_id guard below
+			// surface a structured error if no client_id materializes
+			dcrErr = regErr
 			oauthMode = "public client (PKCE)"
 			c.logger.Warn("⚠️ Dynamic Client Registration not supported - using public client OAuth with PKCE",
 				zap.String("server", c.config.Name),
@@ -1080,9 +1083,11 @@ func (c *Client) handleOAuthAuthorization(ctx context.Context, authErr error, oa
 		}
 	}
 
-	// Continue with OAuth flow regardless of DCR result
-	// Public client OAuth (RFC 8252) with PKCE doesn't require client_id
-	// If server doesn't support this, it will reject the authorization request
+	// Continue with the OAuth flow when a client_id is available (static,
+	// persisted, or obtained via DCR). OAuth public clients (RFC 8252 + PKCE)
+	// still require a client_id — PKCE replaces the client secret, not the
+	// id — so the empty-client_id guard below aborts before opening a
+	// guaranteed-broken authorization URL (issue #975).
 
 	c.logger.Info("🌟 Starting OAuth authentication flow",
 		zap.String("server", c.config.Name),
@@ -1159,36 +1164,12 @@ func (c *Client) handleOAuthAuthorization(ctx context.Context, authErr error, oa
 		}
 	}
 
-	// Check if we're attempting public client OAuth with empty client_id
-	// Some servers (like Figma) advertise DCR but return 403, then reject empty client_id
-	parsedAuthURL, parseErr := url.Parse(authURL)
-	if parseErr == nil {
-		clientIDParam := parsedAuthURL.Query().Get("client_id")
-		if clientIDParam == "" && oauthMode == "public client (PKCE)" {
-			c.logger.Error("❌ OAuth server requires client_id but DCR failed",
-				zap.String("server", c.config.Name),
-				zap.String("url", c.config.URL),
-				zap.String("help", "Configure oauth.client_id in server config or contact the OAuth provider"))
-			// Return structured error for Spec 020
-			return &contracts.OAuthFlowError{
-				Success:    false,
-				ErrorType:  contracts.OAuthErrorClientIDRequired,
-				ErrorCode:  contracts.OAuthCodeNoClientID,
-				ServerName: c.config.Name,
-				Message:    fmt.Sprintf("Server '%s' requires client_id but Dynamic Client Registration returned 403", c.config.Name),
-				Details: &contracts.OAuthErrorDetails{
-					ServerURL: c.config.URL,
-					DCRStatus: &contracts.DCRStatus{
-						Attempted:  true,
-						Success:    false,
-						StatusCode: 403,
-						Error:      "Forbidden",
-					},
-				},
-				Suggestion: "Register an OAuth app with the provider and configure oauth.client_id in server config.",
-				DebugHint:  fmt.Sprintf("For logs: mcpproxy upstream logs %s", c.config.Name),
-			}
-		}
+	// Never proceed with an authorization URL that lacks a client_id — the
+	// provider will reject it (e.g. Figma after a DCR 403, GitHub which has no
+	// DCR endpoint at all; issue #975). Checked on the final URL so a
+	// client_id supplied via oauth.extra_params still passes.
+	if flowErr := c.emptyClientIDFlowError(authURL, "", dcrErr); flowErr != nil {
+		return flowErr
 	}
 
 	// Always log the computed authorization URL so users can copy/paste if auto-launch fails.
@@ -1393,6 +1374,7 @@ func (c *Client) handleOAuthAuthorizationWithResult(ctx context.Context, authErr
 	hasStaticCredentials := c.config.OAuth != nil && c.config.OAuth.ClientID != ""
 	hasPersistedCredentials := oauthConfig.ClientID != ""
 
+	var dcrErr error
 	if !hasStaticCredentials && !hasPersistedCredentials {
 		c.logger.Info("📋 Attempting Dynamic Client Registration (optional)",
 			zap.String("server", c.config.Name))
@@ -1412,31 +1394,12 @@ func (c *Client) handleOAuthAuthorizationWithResult(ctx context.Context, authErr
 		}()
 
 		if regErr != nil {
+			// DCR failed - the empty-client_id guard below surfaces a
+			// structured error if no client_id materializes (issue #975)
+			dcrErr = regErr
 			c.logger.Info("ℹ️ DCR not available, continuing with public client OAuth",
 				zap.String("server", c.config.Name),
 				zap.Error(regErr))
-
-			if strings.Contains(regErr.Error(), "403") {
-				return result, &contracts.OAuthFlowError{
-					Success:       false,
-					ErrorType:     contracts.OAuthErrorClientIDRequired,
-					ErrorCode:     contracts.OAuthCodeNoClientID,
-					ServerName:    c.config.Name,
-					CorrelationID: result.CorrelationID,
-					Message:       fmt.Sprintf("Server '%s' requires client_id but Dynamic Client Registration returned 403", c.config.Name),
-					Details: &contracts.OAuthErrorDetails{
-						ServerURL: c.config.URL,
-						DCRStatus: &contracts.DCRStatus{
-							Attempted:  true,
-							Success:    false,
-							StatusCode: 403,
-							Error:      "Forbidden",
-						},
-					},
-					Suggestion: "Register an OAuth app with the provider and configure oauth.client_id in server config.",
-					DebugHint:  fmt.Sprintf("For logs: mcpproxy upstream logs %s", c.config.Name),
-				}
-			}
 		} else {
 			clientID := oauthHandler.GetClientID()
 			clientSecret := oauthHandler.GetClientSecret()
@@ -1519,6 +1482,12 @@ func (c *Client) handleOAuthAuthorizationWithResult(ctx context.Context, authErr
 		}
 	}
 
+	// Never store or open an authorization URL that lacks a client_id — the
+	// provider is guaranteed to reject it (issue #975).
+	if flowErr := c.emptyClientIDFlowError(authURL, result.CorrelationID, dcrErr); flowErr != nil {
+		return result, flowErr
+	}
+
 	// Store the auth URL in the result
 	result.AuthURL = authURL
 	c.logger.Info("🌐 Authorization URL obtained",
@@ -1914,6 +1883,7 @@ func (c *Client) getAuthorizationURLQuick(ctx context.Context, oauthConfig *clie
 	hasStaticCredentials := c.config.OAuth != nil && c.config.OAuth.ClientID != ""
 	hasPersistedCredentials := oauthConfig.ClientID != ""
 
+	var dcrErr error
 	if !hasStaticCredentials && !hasPersistedCredentials {
 		c.logger.Info("📋 Attempting Dynamic Client Registration (DCR)",
 			zap.String("server", c.config.Name),
@@ -1930,26 +1900,13 @@ func (c *Client) getAuthorizationURLQuick(ctx context.Context, oauthConfig *clie
 		}()
 
 		if regErr != nil {
+			// DCR failed - the empty-client_id guard below surfaces a
+			// structured error if no client_id materializes (issue #975)
+			dcrErr = regErr
 			c.logger.Warn("⚠️ DCR failed",
 				zap.String("server", c.config.Name),
 				zap.String("correlation_id", correlationID),
 				zap.Error(regErr))
-
-			if strings.Contains(regErr.Error(), "403") {
-				c.logger.Error("❌ DCR returned 403 - client_id required",
-					zap.String("server", c.config.Name),
-					zap.String("correlation_id", correlationID),
-					zap.String("suggestion", "Register an OAuth app with the provider"))
-				return "", nil, "", "", &contracts.OAuthFlowError{
-					Success:       false,
-					ErrorType:     contracts.OAuthErrorClientIDRequired,
-					ErrorCode:     contracts.OAuthCodeNoClientID,
-					ServerName:    c.config.Name,
-					CorrelationID: correlationID,
-					Message:       fmt.Sprintf("Server '%s' requires client_id but DCR returned 403", c.config.Name),
-					Suggestion:    "Register an OAuth app with the provider and configure oauth.client_id in server config.",
-				}
-			}
 		} else {
 			c.logger.Info("✅ DCR succeeded",
 				zap.String("server", c.config.Name),
@@ -2017,9 +1974,74 @@ func (c *Client) getAuthorizationURLQuick(ctx context.Context, oauthConfig *clie
 		}
 	}
 
+	// Issue #975: never hand back an authorization URL without a client_id —
+	// the provider is guaranteed to reject it (GitHub 404s on client_id=).
+	if flowErr := c.emptyClientIDFlowError(authURL, correlationID, dcrErr); flowErr != nil {
+		return "", nil, "", "", flowErr
+	}
+
 	return authURL, oauthHandler, codeVerifier, state, nil
 }
 
+// emptyClientIDFlowError returns a structured oauth_client_id_required error
+// when the final authorization URL carries no client_id. OAuth public clients
+// (RFC 8252 + PKCE) still require a client_id — PKCE replaces the client
+// secret, not the id — so a provider is guaranteed to reject such a URL
+// (GitHub responds 404; issue #975). Returns nil when the URL has a client_id
+// or cannot be parsed. dcrErr, when non-nil, is the DCR failure that left the
+// client without an id; its real outcome is preserved in the error details so
+// a 403 rejection (Figma) stays distinguishable from a provider with no
+// registration endpoint at all (GitHub).
+func (c *Client) emptyClientIDFlowError(authURL, correlationID string, dcrErr error) *contracts.OAuthFlowError {
+	parsed, err := url.Parse(authURL)
+	if err != nil {
+		return nil
+	}
+	if parsed.Query().Get("client_id") != "" {
+		// A client_id present in the URL but absent from the OAuth handler
+		// came from oauth.extra_params. That configuration is fully
+		// functional: OAuthTransportWrapper (internal/oauth/config.go) injects
+		// every extra param — client_id included — into token requests as
+		// well, so the exchange after callback carries it too.
+		return nil
+	}
+	c.logger.Error("❌ OAuth provider requires a client_id but none is available (DCR unsupported or failed)",
+		zap.String("server", c.config.Name),
+		zap.String("url", c.config.URL),
+		zap.NamedError("dcr_error", dcrErr),
+		zap.String("help", "Register an OAuth app with the provider and set oauth.client_id in the server config"))
+	details := &contracts.OAuthErrorDetails{
+		ServerURL: c.config.URL,
+	}
+	if dcrErr != nil {
+		dcrStatus := &contracts.DCRStatus{
+			Attempted: true,
+			Success:   false,
+			Error:     dcrErr.Error(),
+		}
+		// Best-effort: mcp-go returns untyped registration errors (a 403 whose
+		// body is valid OAuth JSON surfaces as e.g. "OAuth error:
+		// unauthorized_client" with no status), so the code is only set when
+		// the text makes it unambiguous; the verbatim error above is the
+		// authoritative detail.
+		if strings.Contains(dcrErr.Error(), "403") || strings.Contains(dcrErr.Error(), "Forbidden") {
+			dcrStatus.StatusCode = 403
+		}
+		details.DCRStatus = dcrStatus
+	}
+	return &contracts.OAuthFlowError{
+		Success:       false,
+		ErrorType:     contracts.OAuthErrorClientIDRequired,
+		ErrorCode:     contracts.OAuthCodeNoClientID,
+		ServerName:    c.config.Name,
+		CorrelationID: correlationID,
+		Message:       fmt.Sprintf("Server '%s' requires a client_id: the OAuth provider does not support Dynamic Client Registration (or registration failed) and no oauth.client_id is configured", c.config.Name),
+		Details:       details,
+		Suggestion:    "Register an OAuth app with the provider and set oauth.client_id in the server config.",
+		DebugHint:     fmt.Sprintf("For logs: mcpproxy upstream logs %s", c.config.Name),
+	}
+}
+
 // waitForOAuthCallbackAsync waits for OAuth callback and handles token exchange in background.
 func (c *Client) waitForOAuthCallbackAsync(ctx context.Context, oauthHandler *uptransport.OAuthHandler, codeVerifier, state, correlationID string) {
 	c.markOAuthInProgress()
 
@@ -0,0 +1,138 @@
+package core
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
+)
+
+func newClientIDGuardTestClient(t *testing.T) *Client {
+	t.Helper()
+	return &Client{
+		config: &config.ServerConfig{
+			Name: "github",
+			URL:  "https://api.githubcopilot.com/mcp/",
+		},
+		logger: zap.NewNop(),
+	}
+}
+
+// Issue #975: providers without Dynamic Client Registration (e.g. GitHub) must
+// produce a structured oauth_client_id_required error instead of an
+// authorization URL with an empty client_id, which the provider 404s.
+func TestEmptyClientIDFlowError_EmptyClientID(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	authURL := "https://github.com/login/oauth/authorize?client_id=&code_challenge=abc&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A62876%2Foauth%2Fcallback"
+	flowErr := c.emptyClientIDFlowError(authURL, "corr-123", errors.New("server does not support dynamic client registration"))
+
+	require.NotNil(t, flowErr, "empty client_id in authorization URL must be rejected")
+	assert.Equal(t, contracts.OAuthErrorClientIDRequired, flowErr.ErrorType)
+	assert.Equal(t, contracts.OAuthCodeNoClientID, flowErr.ErrorCode)
+	assert.Equal(t, "github", flowErr.ServerName)
+	assert.Equal(t, "corr-123", flowErr.CorrelationID)
+	assert.Contains(t, flowErr.Suggestion, "oauth.client_id")
+	assert.False(t, flowErr.Success)
+}
+
+func TestEmptyClientIDFlowError_MissingClientIDParam(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	authURL := "https://github.com/login/oauth/authorize?code_challenge=abc&code_challenge_method=S256"
+	flowErr := c.emptyClientIDFlowError(authURL, "", nil)
+
+	require.NotNil(t, flowErr, "authorization URL without client_id param must be rejected")
+	assert.Equal(t, contracts.OAuthErrorClientIDRequired, flowErr.ErrorType)
+}
+
+func TestEmptyClientIDFlowError_PresentClientID(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	authURL := "https://github.com/login/oauth/authorize?client_id=Iv1.abc123&code_challenge=abc"
+	flowErr := c.emptyClientIDFlowError(authURL, "corr-123", nil)
+
+	assert.Nil(t, flowErr, "a URL carrying a client_id must pass the guard")
+}
+
+func TestEmptyClientIDFlowError_ClientIDViaExtraParams(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	// A client_id injected through oauth.extra_params must also satisfy the
+	// guard — the check is on the final URL, not on the handler state.
+	authURL := "https://example.com/authorize?client_id=from-extra-params&resource=https%3A%2F%2Fexample.com"
+	flowErr := c.emptyClientIDFlowError(authURL, "", nil)
+
+	assert.Nil(t, flowErr)
+}
+
+func TestEmptyClientIDFlowError_UnparseableURL(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	// An unparseable URL is not this guard's concern — never block on it.
+	flowErr := c.emptyClientIDFlowError("://not-a-url", "", nil)
+
+	assert.Nil(t, flowErr)
+}
+
+// The structured error must preserve the real DCR outcome: a 403 rejection
+// (e.g. Figma) keeps its status code, a provider without a registration
+// endpoint (e.g. GitHub) keeps the "not supported" message — they are
+// distinguishable in the error details.
+func TestEmptyClientIDFlowError_DCR403Details(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	authURL := "https://example.com/authorize?client_id="
+	flowErr := c.emptyClientIDFlowError(authURL, "", errors.New("registration failed: HTTP 403 Forbidden"))
+
+	require.NotNil(t, flowErr)
+	require.NotNil(t, flowErr.Details)
+	require.NotNil(t, flowErr.Details.DCRStatus)
+	assert.True(t, flowErr.Details.DCRStatus.Attempted)
+	assert.False(t, flowErr.Details.DCRStatus.Success)
+	assert.Equal(t, 403, flowErr.Details.DCRStatus.StatusCode)
+	assert.Contains(t, flowErr.Details.DCRStatus.Error, "403")
+}
+
+func TestEmptyClientIDFlowError_DCRUnsupportedDetails(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	authURL := "https://github.com/login/oauth/authorize?client_id="
+	flowErr := c.emptyClientIDFlowError(authURL, "", errors.New("server does not support dynamic client registration"))
+
+	require.NotNil(t, flowErr)
+	require.NotNil(t, flowErr.Details)
+	require.NotNil(t, flowErr.Details.DCRStatus)
+	assert.True(t, flowErr.Details.DCRStatus.Attempted)
+	assert.False(t, flowErr.Details.DCRStatus.Success)
+	assert.Zero(t, flowErr.Details.DCRStatus.StatusCode)
+	assert.Contains(t, flowErr.Details.DCRStatus.Error, "does not support dynamic client registration")
+}
+
+func TestEmptyClientIDFlowError_NoDCRAttempt(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	// nil dcrErr (DCR not attempted or succeeded): no DCRStatus fabricated.
+	flowErr := c.emptyClientIDFlowError("https://example.com/authorize?client_id=", "", nil)
+
+	require.NotNil(t, flowErr)
+	require.NotNil(t, flowErr.Details)
+	assert.Nil(t, flowErr.Details.DCRStatus)
+}
+
+// Codex r2 finding 2: "Forbidden" without a literal "403" still maps to
+// status_code 403 (best-effort; mcp-go errors are untyped).
+func TestEmptyClientIDFlowError_ForbiddenMapsTo403(t *testing.T) {
+	c := newClientIDGuardTestClient(t)
+
+	flowErr := c.emptyClientIDFlowError("https://example.com/authorize?client_id=", "", errors.New("registration request failed: Forbidden"))
+
+	require.NotNil(t, flowErr)
+	require.NotNil(t, flowErr.Details.DCRStatus)
+	assert.Equal(t, 403, flowErr.Details.DCRStatus.StatusCode)
+}