Use private_key_jwt with these public keys (ES256 or RS256, up to 5). Every client secret stops working.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. The assertion's iss and sub are the client id, its aud the token endpoint or the issuer, at most five minutes old, each jti once. Behind the machineIdentities sub-flag: 404 not_found while it is off. A service account gets tokens from https://auth.50heads.com/token with grant_type=client_credentials and its client id and secret (HTTP Basic or the body) or a private_key_jwt assertion; no refresh token, ask again when it expires.