Interactive authorization settings

Open a hosted authorization server and choose Settings, then Interactive authorization. Select LOCAL_ONLY, FEDERATED_ONLY, or HYBRID behavior and configure the session and reauthentication policy.

The authorization transaction records the route decision before rendering a local form, chooser, or upstream redirect. A federated route pins the external resource and federation binding UUIDs and their revisions. The callback cannot substitute a tenant, hosted resource, binding, client, redirect URI, or transaction.

Federated-only mode requires at least one current, valid, enabled binding. Hybrid mode offers local sign-in alongside only the bindings pinned by the transaction. prompt, max_age, and existing-session evaluation can require reauthentication, but cannot force a route that the resource policy does not allow.

Use the Hosted sign-in and external federation guide to create and validate bindings before enabling federated or hybrid sign-in.

Interactive-authorization settings are fields of the aggregate hosted configuration below the selected UUID:

GET /api/platform/config/v1/tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration
PUT /api/platform/config/v1/tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration