Every time the Server receives a HTTP Request, the event OnOAuth2IsPrivateEndpoint is called to ask if the Endpoint is private or not. By default, is not private.
procedure OnOAuth2IsPrivateEndpoint(Sender: TObject; const aEndpoint: string; var IsPrivate: Boolean);
begin
if aEndpoint = '/private' then
IsPrivate := True;
end;