diff --git a/eng/Versions.props b/eng/Versions.props
index cf90c53cc..f131c6805 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -6,7 +6,7 @@
     <PatchVersion>0</PatchVersion>
     <VersionPrefix>$(MajorVersion).$(MinorVersion).$(PatchVersion)</VersionPrefix>
     <PreReleaseVersionLabel>preview</PreReleaseVersionLabel>
-    <PreReleaseVersionIteration>4</PreReleaseVersionIteration>
+    <PreReleaseVersionIteration>5</PreReleaseVersionIteration>
     <PreReleaseBrandingLabel>Preview $(PreReleaseVersionIteration)</PreReleaseBrandingLabel>
     <StabilizePackageVersion Condition=" '$(StabilizePackageVersion)' == '' ">false</StabilizePackageVersion>
     <DotNetFinalVersionKind Condition=" '$(StabilizePackageVersion)' == 'true' ">release</DotNetFinalVersionKind>
diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml
index f6ecf8db7..8085abcd5 100644
--- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml
+++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml
@@ -1251,6 +1251,28 @@
     </Environment>
   </Provider>
 
+  <!--
+                                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
+                                       █████ ██ ▄▄▄ █▄ ▄██ ▀██ ██ ▄▄▀██ ▄▄ ██ ▄▄ ██
+                                       █████ ██ ███ ██ ███ █ █ ██ ▀▀▄██ ▀▀ ██ █▀▀██
+                                       ██ ▀▀ ██ ▀▀▀ █▀ ▀██ ██▄ ██ ██ ██ █████ ▀▀▄██
+                                       ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+  -->
+
+  <Provider Name="JoinRpg" Id="698f413f-21e1-4be1-9b7f-c96f91bbf41d"
+            Documentation="https://github.com/joinrpg/joinrpg-net/blob/master/docs/adr004-oauth-server.md">
+    <!--
+      Note: the "email", "phone" and "profile" scopes are not strictly required but are requested
+      by default to receive the corresponding standard claims from the userinfo endpoint.
+    -->
+
+    <Environment Issuer="https://id.joinrpg.ru/">
+      <Scope Name="email" Default="true" Required="false" />
+      <Scope Name="phone" Default="true" Required="false" />
+      <Scope Name="profile" Default="true" Required="false" />
+    </Environment>
+  </Provider>
+
   <!--
                                   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                                   █████ ██ ██ ██ ▄▀▄ ██ ▄▄ ██ ▄▄▀██ █████ ▄▄▄ ██ ██ ██ ▄▄▀██
diff --git a/src/OpenIddict.Client/OpenIddictClientHandlers.Protection.cs b/src/OpenIddict.Client/OpenIddictClientHandlers.Protection.cs
index 525491d96..290179c77 100644
--- a/src/OpenIddict.Client/OpenIddictClientHandlers.Protection.cs
+++ b/src/OpenIddict.Client/OpenIddictClientHandlers.Protection.cs
@@ -713,12 +713,6 @@ public ValueTask HandleAsync(ValidateTokenContext context)
 
                 Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
-                // If no specific value is expected, skip the default presenter validation.
-                if (context.ValidPresenters.Count is 0)
-                {
-                    return ValueTask.CompletedTask;
-                }
-
                 // If the token doesn't have any presenter attached, return an error.
                 var presenters = context.Principal.GetPresenters();
                 if (presenters.IsDefaultOrEmpty)
@@ -773,12 +767,6 @@ public ValueTask HandleAsync(ValidateTokenContext context)
 
                 Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
-                // If no specific value is expected, skip the default audience validation.
-                if (context.ValidAudiences.Count is 0)
-                {
-                    return ValueTask.CompletedTask;
-                }
-
                 // If the token doesn't have any audience attached, return an error.
                 var audiences = context.Principal.GetAudiences();
                 if (audiences.IsDefaultOrEmpty)
diff --git a/src/OpenIddict.Client/OpenIddictClientHandlers.cs b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
index ea6f51864..409dc5a1d 100644
--- a/src/OpenIddict.Client/OpenIddictClientHandlers.cs
+++ b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
@@ -2136,6 +2136,8 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                DisableAudienceValidation = true,
+                DisablePresenterValidation = true,
                 Token = context.FrontchannelAccessToken,
                 ValidTokenTypes = { TokenTypeIdentifiers.AccessToken }
             };
@@ -2207,6 +2209,8 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                DisableAudienceValidation = true,
+                DisablePresenterValidation = true,
                 Token = context.AuthorizationCode,
                 ValidTokenTypes = { TokenTypeIdentifiers.Private.AuthorizationCode }
             };
@@ -3838,6 +3842,8 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                DisableAudienceValidation = true,
+                DisablePresenterValidation = true,
                 Token = context.BackchannelAccessToken,
                 ValidTokenTypes = { TokenTypeIdentifiers.AccessToken }
             };
@@ -3907,6 +3913,8 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                DisableAudienceValidation = true,
+                DisablePresenterValidation = true,
                 Token = context.IssuedToken,
                 ValidTokenTypes = { context.IssuedTokenType! }
             };
@@ -3978,6 +3986,8 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                DisableAudienceValidation = true,
+                DisablePresenterValidation = true,
                 Token = context.RefreshToken,
                 ValidTokenTypes = { TokenTypeIdentifiers.RefreshToken }
             };
@@ -4480,6 +4490,8 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                DisableAudienceValidation = true,
+                DisablePresenterValidation = true,
                 Token = context.UserInfoToken,
                 ValidTokenTypes = { TokenTypeIdentifiers.Private.UserInfoToken }
             };
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.Exchange.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.Exchange.cs
index 3a1568c38..845d9b158 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.Exchange.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.Exchange.cs
@@ -412,17 +412,21 @@ public ValueTask HandleAsync(ValidateTokenRequestContext context)
             {
                 ArgumentNullException.ThrowIfNull(context);
 
-                if (!context.Request.IsAuthorizationCodeGrantType() && !context.Request.IsClientCredentialsGrantType())
+                if (!context.Request.IsAuthorizationCodeGrantType() &&
+                    !context.Request.IsClientCredentialsGrantType() &&
+                    !context.Request.IsDeviceCodeGrantType())
                 {
                     return ValueTask.CompletedTask;
                 }
 
-                // Reject grant_type=authorization_code and grant_type=client_credentials requests that
-                // don't specify a client_id or a client_assertion, as the client identity MUST be sent
+                // Reject grant_type=authorization_code, grant_type=client_credentials and
+                // grant_type=urn:ietf:params:oauth:grant-type:device_code requests that don't
+                // specify a client_id or a client_assertion, as the client identity MUST be sent
                 // by the client application (even when using mTLS OAuth 2.0 client authentication).
                 //
-                // See https://tools.ietf.org/html/rfc6749#section-4.1.3
-                // and https://tools.ietf.org/html/rfc6749#section-4.4.1 for more information.
+                // See https://tools.ietf.org/html/rfc6749#section-4.1.3,
+                // https://tools.ietf.org/html/rfc6749#section-4.4.1 and
+                // https://tools.ietf.org/html/rfc8628#section-3.4 for more information.
                 if (string.IsNullOrEmpty(context.Request.ClientId) &&
                     string.IsNullOrEmpty(context.Request.ClientAssertion))
                 {
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs
index 01b1aed90..d4e80813f 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs
@@ -999,12 +999,6 @@ public ValueTask HandleAsync(ValidateTokenContext context)
 
                 Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
-                // If no specific value is expected, skip the default presenter validation.
-                if (context.ValidPresenters.Count is 0)
-                {
-                    return ValueTask.CompletedTask;
-                }
-
                 // If the token doesn't have any presenter attached, return an error.
                 var presenters = context.Principal.GetPresenters();
                 if (presenters.IsDefaultOrEmpty)
@@ -1059,12 +1053,6 @@ public ValueTask HandleAsync(ValidateTokenContext context)
 
                 Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
-                // If no specific value is expected, skip the default audience validation.
-                if (context.ValidAudiences.Count is 0)
-                {
-                    return ValueTask.CompletedTask;
-                }
-
                 // If the token doesn't have any audience attached, return an error.
                 var audiences = context.Principal.GetAudiences();
                 if (audiences.IsDefaultOrEmpty)
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.cs
index ae5d97a72..da72dcb02 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.cs
@@ -785,7 +785,7 @@ public ValueTask HandleAsync(ProcessAuthenticationContext context)
             // For more information, see
             // https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication and
             // https://datatracker.ietf.org/doc/html/rfc7523#section-3.
-            if (context.ClientAssertionPrincipal.GetAudiences() is not [_])
+            if (context.ClientAssertionPrincipal.GetAudiences() is not [{ Length: > 0 }])
             {
                 context.Reject(
                     error: Errors.InvalidRequest,
@@ -814,15 +814,21 @@ public ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             static bool ValidateClaimGroup(string name, List<Claim> values) => name switch
             {
-                // The following claims MUST be represented as unique strings.
-                //
-                // Important: client assertions with multiple audiences was initially deliberately supported by
-                // the OpenID Connect and Assertion Framework for OAuth 2.0 Client Authentication specifications.
-                // Since 2025, using multiple audiences is no longer allowed for security reasons. As such, the
-                // "aud" claim present in client assertions MUST always be represented as a single string.
+                // The following claims MUST be represented as unique strings or array of strings.
                 //
-                // See https://www.ietf.org/archive/id/draft-ietf-oauth-rfc7523bis-01.html#section-4 for more information.
-                Claims.Audience or Claims.AuthorizedParty or Claims.Issuer or Claims.JwtId or Claims.Subject
+                // Note: the initial version of the "Updates to Audience Values for OAuth 2.0 Authorization Servers"
+                // specification initially required that the "aud" claim be represented as a unique string but more
+                // recent versions of the specification allow the "aud" claim to be represented as a JSON array of strings.
+                Claims.Audience => values.TrueForAll(static value => value.ValueType is ClaimValueTypes.String) ||
+                    // Note: a unique claim using the special JSON_ARRAY claim value type is allowed
+                    // if the individual elements of the parsed JSON array are all string values.
+                    (values is [{ ValueType: JsonClaimValueTypes.JsonArray, Value: string value }] &&
+                    JsonSerializer.Deserialize(value, OpenIddictSerializer.Default.JsonElement)
+                        is { ValueKind: JsonValueKind.Array } element &&
+                    OpenIddictHelpers.ValidateArrayElements(element, JsonValueKind.String)),
+
+                // The following claims MUST be represented as unique strings.
+                Claims.AuthorizedParty or Claims.Issuer or Claims.JwtId or Claims.Subject
                     => values is [{ ValueType: ClaimValueTypes.String }],
 
                 // The following claims MUST be represented as unique numeric dates.
@@ -951,11 +957,12 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
                     case OpenIddictServerEndpointType.Revocation    when context.Options.AcceptAnonymousClients:
                         return;
 
-                    // Note: the authorization code and client credentials grant types never
-                    // allow anonymous clients, even if the corresponding option is enabled.
+                    // Note: the authorization code, device code and client credentials grant types
+                    // never allow anonymous clients, even if the corresponding option is enabled.
                     case OpenIddictServerEndpointType.Token when context.Options.AcceptAnonymousClients &&
                         !context.Request.IsAuthorizationCodeGrantType() &&
-                        !context.Request.IsClientCredentialsGrantType():
+                        !context.Request.IsClientCredentialsGrantType() &&
+                        !context.Request.IsDeviceCodeGrantType():
                         return;
 
                     // Note: despite being conceptually similar to the token endpoint, the pushed authorization
@@ -963,6 +970,15 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
                     // for both regular authorization requests and pushed authorization requests.
                     //
                     // See https://datatracker.ietf.org/doc/html/rfc9126#section-2.1 for more information.
+
+                    // Note: similarly, the device authorization endpoint doesn't allow anonymous clients,
+                    // as a client_id parameter is always required by the specification if the client
+                    // doesn't authenticate using a different method.
+                    //
+                    // See https://datatracker.ietf.org/doc/html/rfc9126#section-3.1 for more information.
+                    case OpenIddictServerEndpointType.DeviceAuthorization:
+                    case OpenIddictServerEndpointType.PushedAuthorization:
+                        break;
                 }
 
                 context.Logger.LogInformation(6220, SR.GetResourceString(SR.ID6220), Parameters.ClientId);
@@ -1054,7 +1070,7 @@ OpenIddictServerEndpointType.EndUserVerification or
                 if (context.EndpointType is OpenIddictServerEndpointType.Token &&
                     context.Request.IsClientCredentialsGrantType())
                 {
-                    context.Logger.LogInformation(6222, SR.GetResourceString(SR.ID6222), context.Request.ClientId);
+                    context.Logger.LogInformation(6222, SR.GetResourceString(SR.ID6222), context.ClientId);
 
                     context.Reject(
                         error: Errors.UnauthorizedClient,
@@ -1633,7 +1649,7 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
             var notification = new ValidateTokenContext(context.Transaction)
             {
                 DisableAudienceValidation = true,
-                // Presenter validation is disabled for the token endpoint as this endpoint
+                // Presenter validation is disabled for the authorization code grant as it
                 // implements a specialized event handler that uses more complex rules.
                 DisablePresenterValidation = context.EndpointType is OpenIddictServerEndpointType.Token &&
                                              context.Request.IsAuthorizationCodeGrantType(),
@@ -1712,7 +1728,7 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
             var notification = new ValidateTokenContext(context.Transaction)
             {
                 DisableAudienceValidation = true,
-                // Presenter validation is disabled for the token endpoint as this endpoint
+                // Presenter validation is disabled for the device code grant as it
                 // implements a specialized event handler that uses more complex rules.
                 DisablePresenterValidation = context.EndpointType is OpenIddictServerEndpointType.Token &&
                                              context.Request.IsDeviceCodeGrantType(),
@@ -1973,7 +1989,7 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
             var notification = new ValidateTokenContext(context.Transaction)
             {
                 DisableAudienceValidation = true,
-                // Presenter validation is disabled for the token endpoint as this endpoint
+                // Presenter validation is disabled for the refresh token grant as it
                 // implements a specialized event handler that uses more complex rules.
                 DisablePresenterValidation = context.EndpointType is OpenIddictServerEndpointType.Token &&
                                              context.Request.IsRefreshTokenGrantType(),
diff --git a/src/OpenIddict.Validation/OpenIddictValidationHandlers.Protection.cs b/src/OpenIddict.Validation/OpenIddictValidationHandlers.Protection.cs
index 6414021d1..788e8d12c 100644
--- a/src/OpenIddict.Validation/OpenIddictValidationHandlers.Protection.cs
+++ b/src/OpenIddict.Validation/OpenIddictValidationHandlers.Protection.cs
@@ -705,12 +705,6 @@ public ValueTask HandleAsync(ValidateTokenContext context)
 
                 Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
-                // If no specific value is expected, skip the default presenter validation.
-                if (context.ValidPresenters.Count is 0)
-                {
-                    return ValueTask.CompletedTask;
-                }
-
                 // If the token doesn't have any presenter attached, return an error.
                 var presenters = context.Principal.GetPresenters();
                 if (presenters.IsDefaultOrEmpty)
@@ -765,12 +759,6 @@ public ValueTask HandleAsync(ValidateTokenContext context)
 
                 Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
-                // If no specific value is expected, skip the default audience validation.
-                if (context.ValidAudiences.Count is 0)
-                {
-                    return ValueTask.CompletedTask;
-                }
-
                 // If the token doesn't have any audience attached, return an error.
                 var audiences = context.Principal.GetAudiences();
                 if (audiences.IsDefaultOrEmpty)
diff --git a/src/OpenIddict.Validation/OpenIddictValidationHandlers.cs b/src/OpenIddict.Validation/OpenIddictValidationHandlers.cs
index 6e9285539..5bb6c3255 100644
--- a/src/OpenIddict.Validation/OpenIddictValidationHandlers.cs
+++ b/src/OpenIddict.Validation/OpenIddictValidationHandlers.cs
@@ -977,12 +977,14 @@ public async ValueTask HandleAsync(ProcessAuthenticationContext context)
 
             var notification = new ValidateTokenContext(context.Transaction)
             {
+                // Note: by default, access tokens are not constrainted to specific presenters but must contain
+                // at least one audience matching one of the values configured in the options, if applicable.
+                DisableAudienceValidation = context.Options.Audiences.Count is 0,
+                DisablePresenterValidation = true,
                 Token = context.AccessToken,
                 ValidTokenTypes = { TokenTypeIdentifiers.AccessToken }
             };
 
-            // Note: by default, access tokens are not constrainted to specific presenters but must contain
-            // at least one audience matching one of the values configured in the options, if applicable.
             notification.ValidAudiences.UnionWith(context.Options.Audiences);
 
             await _dispatcher.DispatchAsync(notification);
diff --git a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Exchange.cs b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Exchange.cs
index c03e75245..bcfc94279 100644
--- a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Exchange.cs
+++ b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Exchange.cs
@@ -193,6 +193,27 @@ public async Task ValidateTokenRequest_MissingClientIdCausesAnErrorForClientCred
         Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
     }
 
+    [Fact]
+    public async Task ValidateTokenRequest_MissingClientIdCausesAnErrorForDeviceCodeRequests()
+    {
+        // Arrange
+        await using var server = await CreateServerAsync(options => options.EnableDegradedMode());
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            ClientId = null,
+            DeviceCode = "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
+            GrantType = GrantTypes.DeviceCode
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidRequest, response.Error);
+        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
+    }
+
     [Fact]
     public async Task ValidateTokenRequest_MissingCodeCausesAnError()
     {
@@ -943,6 +964,17 @@ public async Task ValidateTokenRequest_ExpiredDeviceCodeCausesAnError()
                 builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
             });
 
+            options.Services.AddSingleton(CreateApplicationManager(mock =>
+            {
+                var application = new OpenIddictApplication();
+
+                mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(application);
+
+                mock.Setup(manager => manager.HasClientTypeAsync(application, ClientTypes.Public, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+            }));
+
             options.Services.AddSingleton(manager);
         });
 
@@ -951,6 +983,7 @@ public async Task ValidateTokenRequest_ExpiredDeviceCodeCausesAnError()
         // Act
         var response = await client.PostAsync("/connect/token", new OpenIddictRequest
         {
+            ClientId = "Fabrikam",
             GrantType = GrantTypes.DeviceCode,
             DeviceCode = "g43LaWCUrz2RaLILz2L1bg1bOpMSv1hGrH12IIkB9H4"
         });
@@ -2499,67 +2532,6 @@ public async Task ValidateTokenRequest_ClientCredentialsRequestIsRejectedWhenCre
         Assert.Equal(SR.FormatID8000(SR.ID2057), response.ErrorUri);
     }
 
-    [Fact]
-    public async Task ValidateTokenRequest_RequestWithoutClientIdIsRejectedWhenClientIdentificationIsRequired()
-    {
-        // Arrange
-        await using var server = await CreateServerAsync(options =>
-        {
-            options.EnableDegradedMode();
-            options.Configure(options => options.AcceptAnonymousClients = false);
-        });
-
-        await using var client = await server.CreateClientAsync();
-
-        // Act
-        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
-        {
-            ClientId = null,
-            GrantType = GrantTypes.Password,
-            Username = "johndoe",
-            Password = "A3ddj3w"
-        });
-
-        // Assert
-        Assert.Equal(Errors.InvalidClient, response.Error);
-        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
-        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
-    }
-
-    [Fact]
-    public async Task ValidateTokenRequest_RequestIsRejectedWhenClientCannotBeFound()
-    {
-        // Arrange
-        var manager = CreateApplicationManager(mock =>
-        {
-            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
-                .ReturnsAsync(value: null);
-        });
-
-        await using var server = await CreateServerAsync(options =>
-        {
-            options.Services.AddSingleton(manager);
-        });
-
-        await using var client = await server.CreateClientAsync();
-
-        // Act
-        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
-        {
-            ClientId = "Fabrikam",
-            GrantType = GrantTypes.Password,
-            Username = "johndoe",
-            Password = "A3ddj3w"
-        });
-
-        // Assert
-        Assert.Equal(Errors.InvalidClient, response.Error);
-        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
-        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
-
-        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
-    }
-
     [Fact]
     public async Task ValidateTokenRequest_ClientCredentialsRequestFromPublicClientIsRejected()
     {
diff --git a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Introspection.cs b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Introspection.cs
index 2d67d10d9..43ee0e528 100644
--- a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Introspection.cs
+++ b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Introspection.cs
@@ -250,62 +250,6 @@ public async Task ValidateIntrospectionRequest_RequestIsRejectedWhenMultipleCred
         Assert.Equal(SR.FormatID8000(SR.ID2087), response.ErrorUri);
     }
 
-    [Fact]
-    public async Task ValidateIntrospectionRequest_RequestWithoutClientIdIsRejectedWhenClientIdentificationIsRequired()
-    {
-        // Arrange
-        await using var server = await CreateServerAsync(options =>
-        {
-            options.Configure(options => options.AcceptAnonymousClients = false);
-        });
-
-        await using var client = await server.CreateClientAsync();
-
-        // Act
-        var response = await client.PostAsync("/connect/introspect", new OpenIddictRequest
-        {
-            Token = "2YotnFZFEjr1zCsicMWpAA"
-        });
-
-        // Assert
-        Assert.Equal(Errors.InvalidClient, response.Error);
-        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
-        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
-    }
-
-    [Fact]
-    public async Task ValidateIntrospectionRequest_RequestIsRejectedWhenClientCannotBeFound()
-    {
-        // Arrange
-        var manager = CreateApplicationManager(mock =>
-        {
-            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
-                .ReturnsAsync(value: null);
-        });
-
-        await using var server = await CreateServerAsync(options =>
-        {
-            options.Services.AddSingleton(manager);
-        });
-
-        await using var client = await server.CreateClientAsync();
-
-        // Act
-        var response = await client.PostAsync("/connect/introspect", new OpenIddictRequest
-        {
-            ClientId = "Fabrikam",
-            ClientSecret = "7Fjfp0ZBr1KtDRbnfVdmIw",
-            Token = "2YotnFZFEjr1zCsicMWpAA"
-        });
-
-        // Assert
-        Assert.Equal(Errors.InvalidClient, response.Error);
-        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
-        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
-
-        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.Once());
-    }
-
     [Fact]
     public async Task ValidateIntrospectionRequest_RequestIsRejectedWhenEndpointPermissionIsNotGranted()
     {
diff --git a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Revocation.cs b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Revocation.cs
index 8dce3ff00..fe16602a4 100644
--- a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Revocation.cs
+++ b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Revocation.cs
@@ -247,63 +247,6 @@ public async Task ValidateRevocationRequest_RequestIsRejectedWhenMultipleCredent
         Assert.Equal(SR.FormatID8000(SR.ID2087), response.ErrorUri);
     }
 
-    [Fact]
-    public async Task ValidateRevocationRequest_RequestWithoutClientIdIsRejectedWhenClientIdentificationIsRequired()
-    {
-        // Arrange
-        await using var server = await CreateServerAsync(options =>
-        {
-            options.Configure(options => options.AcceptAnonymousClients = false);
-        });
-
-        await using var client = await server.CreateClientAsync();
-
-        // Act
-        var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
-        {
-            Token = "SlAV32hkKG",
-            TokenTypeHint = TokenTypeHints.RefreshToken
-        });
-
-        // Assert
-        Assert.Equal(Errors.InvalidClient, response.Error);
-        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
-        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
-    }
-
-    [Fact]
-    public async Task ValidateRevocationRequest_RequestIsRejectedWhenClientCannotBeFound()
-    {
-        // Arrange
-        var manager = CreateApplicationManager(mock =>
-        {
-            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
-                .ReturnsAsync(value: null);
-        });
-
-        await using var server = await CreateServerAsync(options =>
-        {
-            options.Services.AddSingleton(manager);
-        });
-
-        await using var client = await server.CreateClientAsync();
-
-        // Act
-        var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
-        {
-            ClientId = "Fabrikam",
-            Token = "SlAV32hkKG",
-            TokenTypeHint = TokenTypeHints.RefreshToken
-        });
-
-        // Assert
-        Assert.Equal(Errors.InvalidClient, response.Error);
-        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
-        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
-
-        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
-    }
-
     [Fact]
     public async Task ValidateRevocationRequest_RequestIsRejectedWhenEndpointPermissionIsNotGranted()
     {
diff --git a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.cs b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.cs
index 466d42403..4c32c4904 100644
--- a/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.cs
+++ b/test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.cs
@@ -903,6 +903,234 @@ public async Task ProcessAuthentication_ValidAudiencesAreAttachedToClientAsserti
         Assert.NotNull(response.AccessToken);
     }
 
+    [Fact]
+    public async Task ProcessAuthentication_MissingClientIdInDeviceRequestCausesAnError()
+    {
+        // Arrange
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Configure(options => options.AcceptAnonymousClients = false);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/device", new OpenIddictRequest
+        {
+            ClientId = null
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_InvalidClientIdInDeviceRequestCausesAnError()
+    {
+        // Arrange
+        var manager = CreateApplicationManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(value: null);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/device", new OpenIddictRequest
+        {
+            ClientId = "Fabrikam"
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.Once());
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_MissingClientIdInIntrospectionRequestCausesAnError()
+    {
+        // Arrange
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Configure(options => options.AcceptAnonymousClients = false);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/introspect", new OpenIddictRequest
+        {
+            Token = "2YotnFZFEjr1zCsicMWpAA"
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_InvalidClientIdInIntrospectionRequestCausesAnError()
+    {
+        // Arrange
+        var manager = CreateApplicationManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(value: null);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/introspect", new OpenIddictRequest
+        {
+            ClientId = "Fabrikam",
+            ClientSecret = "7Fjfp0ZBr1KtDRbnfVdmIw",
+            Token = "2YotnFZFEjr1zCsicMWpAA"
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.Once());
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_MissingClientIdInRevocationRequestCausesAnError()
+    {
+        // Arrange
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Configure(options => options.AcceptAnonymousClients = false);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
+        {
+            Token = "SlAV32hkKG",
+            TokenTypeHint = TokenTypeHints.RefreshToken
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_InvalidClientIdInRevocationRequestCausesAnError()
+    {
+        // Arrange
+        var manager = CreateApplicationManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(value: null);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
+        {
+            ClientId = "Fabrikam",
+            ClientSecret = "7Fjfp0ZBr1KtDRbnfVdmIw",
+            Token = "2YotnFZFEjr1zCsicMWpAA"
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.Once());
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_MissingClientIdInTokenRequestCausesAnError()
+    {
+        // Arrange
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Configure(options => options.AcceptAnonymousClients = false);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            ClientId = null,
+            Code = "SplxlOBeZQQYbYS6WxSbIA",
+            GrantType = GrantTypes.Password,
+            Username = "johndoe",
+            Password = "A3ddj3w"
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2029(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2029), response.ErrorUri);
+    }
+
+    [Fact]
+    public async Task ProcessAuthentication_InvalidClientIdInTokenRequestCausesAnError()
+    {
+        // Arrange
+        var manager = CreateApplicationManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(value: null);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            ClientId = "Fabrikam",
+            GrantType = GrantTypes.Password,
+            Username = "johndoe",
+            Password = "A3ddj3w"
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidClient, response.Error);
+        Assert.Equal(SR.FormatID2052(Parameters.ClientId), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2052), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
+    }
+
     [Theory]
     [InlineData(OpenIddictServerEndpointType.DeviceAuthorization)]
     [InlineData(OpenIddictServerEndpointType.Introspection)]