Apps
API information
The oauth2app
resource is managed by the Auth API.
XPKit Portal
Apps are managed in XPKit Portal.
When creating an app using the client credentials flow you can only assign your applications (up to) the same permissions you have been assigned yourself.
For the authorization code flow, users will be granted permissions based on the groups they have been assigned (by an administrator) in XPKit Portal.