Use the device authorization grant for sandboxed agents. Sandboxed agents cannot bind a local port, so they authenticate with the OAuth device flow instead of localhost loopback.