Controls how the platform issues and validates OAuth 2.0 access tokens for third-party applications and API clients.

Access Token Options

Require Application Registration: When enabled, only OAuth clients that have been explicitly registered in the platform can request access tokens. Disable to allow any client to obtain tokens without pre-registration.
Issue Refresh Tokens for Unregistered Requests: When application registration is not required, controls whether refresh tokens are issued to unregistered clients. Enabled by default.
Default Expiry Time: The lifetime of an access token in seconds. Default is 3600 seconds (1 hour).

Device Code Flow

Settings for the OAuth 2.0 Device Authorization Grant (RFC 8628), used by devices with limited input capability (e.g. smart TVs, CLIs).

Device Code Expiry Time: How long a device code remains valid, in seconds. Default is 1800 seconds (30 minutes).
Device Code Interval: Minimum seconds between polling requests from the device. Default is 5 seconds.
Device Code Pattern: Pattern used to generate human-readable device codes. Default is AAAAAA (six uppercase letters).

OAuth 2.0 clients must include the Authorization header with a valid Bearer token on API requests. Configure client applications to use this platform as the authorisation server endpoint.