HTTPS requirements
Production redirect URIs and website URLs must use HTTPS. Sandbox environments may use localhost for development.
Redirect URI validation
Only exact, pre-registered redirect URIs are permitted. Wildcard patterns are rejected.
Client secret handling
Client secrets are generated only after admin approval. Secrets are shown once and stored hashed. Never embed secrets in public client-side code.
Permission-based scopes
Applications should request the minimum scopes required for support portal integration.
Workspace approval review
All OAuth-style applications require manual review before production activation.
Abuse and policy reporting
Report suspected misuse to [email protected] with relevant details.
Activity and audit logs
Important application events, configuration changes, and review actions are recorded for security review.