Why we didn't add a token_delivery parameter
A request flag with a safe default is not a safe design, because an attacker simply doesn't take the default. How refresh-token delivery moved off the request.
Keeping accounts, tokens and data safe, in Canopy and in the apps built on it.
A request flag with a safe default is not a safe design, because an attacker simply doesn't take the default. How refresh-token delivery moved off the request.