Support
OAuth links, expired tokens, fraud-prevention headers, and test vs live.
Hydra refuses to call MTD APIs when browser metadata is incomplete.
How Hydra isolates test and live HMRC gateways so credentials never cross.