Keywords: 
Dear developers,
we implemented the feature Well-known URL in production on 15th of December.
The wellknown endpoint must be called in conjunction with a QWAC certificate. If the endpoint is called without a certificate, the process ends in a 403 Forbidden.
To better understand this breaking change we invite you to read the HowTo here:
https://psd2.developer.commerzbank.com/content/howto/build-authorize-url
If you have any further questions about this, please feel free to contact PSD2 support at any time.
Your Commerzbank Support-Team