Record application details
Use a recognizable service name and a contact address available to maintainers. Describe the integration and the data it uses. These details help owners understand why access exists. Separate development and production applications when the connected service supports it.
Select minimum permissions
Map each permission to a required feature using the service’s reference. Start with read-only access when sufficient. Do not request broad permissions to solve an unexplained error; inspect the documented response first. Record the reason for each permission for future reviews.
Verify the authorization flow
Register the exact callback address and follow the service’s rules for matching redirect_uri. Use its recommended protection against request forgery and code interception. A code in a URL does not prove authentication. Test with non-sensitive data and provide a way to revoke access.