Manage OAuth settings
The OAuth settings enable you to configure the access token and any refresh tokens issued for your OpenID Connect (OIDC) applications when requesting user authorization. We support OAuth authorization code, refresh token, implicit and hybrid (both code and implicit) grant types. We issue an OAuth access token for an application only when "token" is one of the response_type values specified in the application’s authorization request.
When we issue an access token it contains attributes required by the OIDC specification as well as any other attributes you assign for the OAuth attributes contract.
| For managed accounts, the OAuth settings apply only to your managed applications, not to applications supplied by a service provider. |
As part of the authorization request, we require the scopes (permissable user resources) you assign when authorizing users.
You can also specify attribute mappings (OAuth claims to identity repository attributes) both at the account level and at the application. The account-level settings can be overridden when you configure the attribute mapping at the application level (when you are adding the OIDC application).