This one is related with an issue detected in the istio adapter.

Here's the PR: https://github.com/3scale/apisonator/pull/280

The PR description contains all the details. In summary, with this change, it's possible to use the authorize and report endpoints with OIDC services instead of being force to use the oauth_* ones, and it should not require specifying an app_key parameter.