mod_http_oauth2: Reduce authorization code validity time to 2 minutes RFC 6749 states > A maximum authorization code lifetime of 10 minutes is RECOMMENDED. So 15 minutes was way too long. I was thinking 5 minutes at first but since this should generally be instant, I settled on 2 minutes as a large guesstimate on how slow it might be on slow links.

module:hook("authentication-success", function (event)
	local session = event.session;
	local sasl_handler = session.sasl_handler;
	session.log("info", "Authenticated with %s", sasl_handler and sasl_handler.selected or "legacy auth");
end);