Configure Mobile clients

Mobile applications (like Medallia Mobile and Medallia Voices) use OAuth to authorize communications with Medallia Experience Cloud. The default OAuth configurations work without need to be changed. However, companies may choose to make configuration changes to conform with company policy.

Configure OAuth for the Medallia mobile applications on the Clients screen. The mobile clients are:
  • medallia_mobile (old, deprecated version)
  • medallia_mobile3
  • medallia_voices

Timeouts and idle sessions

The mobile applications allow users to sign in, and remain signed in for 30 days, after which time the user needs to re-sign in to use the application. Companies often change the timeouts to:

  • Require more frequent re-sign-in as specified with the Refresh token lifetime property. Minimally, the frequency can be daily.

  • Force a re-sign in after some period of inactivity. For example, a mobile application that has not accessed the server in the last two hours could have its access revoked until the user re-signs in.

For more information, see Configure OAuth timeouts

IP allow-list

Some companies require user to use the app only when connected to the company network, such as on the company WiFi or when using a VPN to connect to the network. Users not on the network cannot receive an OAuth access token, thereby denying them access to the application, that is, its data.

To configure IP allow-lists for a company:

  1. Define all the company's allow-list addresses on the Logon Restrictions screen.

  2. For each OAuth client that requires such access, turn on the Enforce IP allow-listing on access token refresh property on the Clients screen.

For more information, see Allow OAuth clients.