diff --git a/lib/annot_at/atproto/oauth/discovery.ex b/lib/annot_at/atproto/oauth/discovery.ex
index c8f514e..0a01465 100644
--- a/lib/annot_at/atproto/oauth/discovery.ex
+++ b/lib/annot_at/atproto/oauth/discovery.ex
@@ -42,7 +42,8 @@ defmodule AnnotAt.Atproto.OAuth.Discovery do
   defp authorization_server(resource, pds_endpoint) do
     with :ok <- verify_resource(resource, pds_endpoint) do
       case Map.get(resource, "authorization_servers") do
-        [issuer | _] when is_binary(issuer) -> {:ok, issuer}
+        # There has to be exactly one issuer according to the spec.
+        [issuer] when is_binary(issuer) -> {:ok, issuer}
         _ -> {:error, :no_authorization_server}
       end
     end
diff --git a/lib/annot_at/atproto/oauth/login.ex b/lib/annot_at/atproto/oauth/login.ex
index 515e1b7..5b1e3d5 100644
--- a/lib/annot_at/atproto/oauth/login.ex
+++ b/lib/annot_at/atproto/oauth/login.ex
@@ -185,7 +185,7 @@ defmodule AnnotAt.Atproto.OAuth.Login do
 
       {:error, reason} ->
         Logger.warning("failed to fetch profile for #{handle}: #{inspect(reason)}")
-        %{display_name: nil, avatar: nil}
+        %{display_name: nil, avatar_url: nil}
     end
   end
 end