Hi Nick , thanks for the response, like i mentioned i dont want to change the default one , so am trying the inbound app option . in that case if the caller is a backend (agent) and he has the client id and secret how can he actually generate a token on behalf of a user , i dont understand how can i work with the "Permissions scopes" , there is no user in this flow so i need to pass somehow the user id/email when calling the oauth2/v1/apps/token , or pass custom

customClaims

in the call