Per-Client Overrides

Each registered OAuth2 client can override a subset of the global runtime settings. Overrides are stored in the clients table and applied per-request based on the client_id in the authorization request.

Unset overrides (null) fall through to the current global runtime settings. There is no need to repeat the global default — only set what differs.

Setting overrides

Via Admin UI: Clients → select a client → Edit → expand the Configuration Overrides section.

Via API at registration:

curl -X POST https://auth.example.com/oauth2/register \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Mobile App",
    "client_type": "public",
    "redirect_uris": ["myapp://callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "access_token_expiration": "30m",
    "refresh_token_expiration": "168h",
    "trust_device_enabled": true,
    "trust_device_expiration": "720h"
  }'

Via API on an existing client:

curl -X PUT https://auth.example.com/oauth2/register/YOUR_CLIENT_ID \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "access_token_expiration": "1h",
    "allowed_audiences": ["https://api.example.com", "https://other-api.example.com"]
  }'

Tip

Duration strings use Go’s time.Duration format: "15m", "1h", "720h", "30s". A value of "0" means no idle expiration (e.g. sso_session_idle_timeout: "0" means sessions for that client never expire from inactivity).

---

Available overrides

access_token_expiration

Access token lifetime for tokens issued to this client. Overrides the global access_token_expiration. Example: "30m".

refresh_token_expiration

Refresh token lifetime for this client. Overrides the global refresh_token_expiration. Example: "168h" (7 days).

authorization_code_expiration

Authorization code TTL for this client, resolved from the current registration when the code is issued. The override also applies after MFA, consent, email verification, passkey or federation completion, even if it changed while the flow was pending. Overrides the global authorization_code_expiration.

allowed_audiences

String array of additional aud values added to access tokens for this client. Example: ["https://api.example.com"]. When set, extends the global access_token_audience setting. To grant a client access to the admin API, include "autentico-admin" in this array.

allow_self_signup

Override the global allow_self_signup setting for this client’s login page and signup submission. An explicit false blocks registration even when globally enabled; true permits it even when globally disabled. Both password and passkey signup check the current registration.

sso_session_idle_timeout

Override the idle timeout when this client attempts to reuse an IdP session, including prompt=none. "0" disables this browser idle check. The background cleanup sweep still uses the global sso_session_idle_timeout, so it can deactivate a session before a more permissive client timeout. This does not change the global maximum age.

trust_device_enabled

Enable or disable trusted devices for users authenticating through this client. Applies to password and magic-link MFA bypass, the MFA checkbox, and trusted-device creation. An explicit false prevents direct cookie-based bypass during fresh password or magic-link login, even if the browser has a valid device cookie from another client. Shared SSO can still reuse an existing authenticated IdP session, including one established through trusted-device bypass at another client; this setting alone is not a fresh-MFA requirement. Use prompt=login to request fresh authentication. The MFA page and submission use the client in the stored challenge, not a posted client_id. Overrides the global trust_device_enabled.

trust_device_expiration

Override the lifetime of new trusted-device records and cookies issued through this client. The current setting is read again on MFA submission. Existing device records retain their original expiry. Overrides the global trust_device_expiration.

consent_required

When enabled (true), users authenticating through this client must explicitly approve the requested OAuth2 scopes on a consent screen before the authorization code is issued. Consent decisions are remembered per user + client + scope combination — subsequent logins skip the consent screen unless the requested scopes change.

---

Precedence example

Given this global configuration:

access_token_expiration = 15m
trust_device_enabled = false

And a client configured with:

{
  "access_token_expiration": "1h",
  "trust_device_enabled": true
}

Requests from that client will produce access tokens valid for 1 hour, with trusted device support enabled, while all other clients continue to use the 15-minute default with trusted devices disabled.