New since request-format discovery: the official authentication page distinguished credential-to-token exchange from a browser consent flow. Current enterprise terms clarified third-party use restrictions. This supported account-connectivity scoping without using credentials.
Task completed