Target OAuth access tokens to a specific API

OAuth clients can send a resource URI during authorization or device authorization to request a token for a specific API. Account Chief carries that audience through token exchange and refresh, and rejects a token request for a different resource.

See the Account Chief developer documentation for OAuth integration guidance.