There are four ways an application can obtain access. You choose which are permitted, both site-wide and per application.
Standard browser sign-in
The user is sent to ActiveManage, signs in, approves the application, and is sent back. This is what nearly every application should use, and it is enabled by default.
Leave Require PKCE on. It ties the exchange to the application that started it, so an intercepted sign-in is useless to anybody else. Leave "plain" PKCE off — it provides no real protection and exists only for legacy applications.
Staying signed in
Lets an application keep a user signed in without sending them through sign-in each time.
The credential is replaced every time it is used, and an attempt to reuse an old one is treated as evidence of theft — the whole chain is cancelled immediately. This has one practical consequence worth telling developers: an application must always store the newest credential it receives. One that keeps re-sending its original will find itself signed out.
Machine-to-machine
The application authenticates as itself, with no user involved, so nothing is limited by anybody's permissions. Use it only for a trusted server-to-server integration, and only with a confidential application. Off by default.
Devices with no keyboard
For a television, set-top box or command-line tool. The device shows a short code; the user types it on their phone to approve it. Because that code is short enough for a human to type, this is the most exposed grant — protected by a ten-minute expiry and an attempt limit. Off by default.