1. 
2. Click the 'Configure' link next to the application link that you want to configure Trusted Apps authentication for.
3. Click the 'Incoming Authentication' tab. The outgoing authentication page will show, with the 'Trusted Apps' tab displayed.
4. The tab will show whether Trusted Apps is currently enabled or not. Use the Modify or Configure buttons respectively to configure Trusted Apps. The Trusted Apps configuration settings will be displayed:
   • 'IP Patterns' — Enter the IP addresses (IPv4 only) from which our application will accept requests. You can specify wildcard matches by using an asterisk (*), e.g. '192.111.*.*' (note, you cannot use netmasks to specify network ranges). If you are entering multiple IP addresses, separate them with commas or spaces.
     Please note, if you are setting up trusted apps between two applications that both have the Application Links plugin installed, you can leave this field blank (or explicitly use *.*.*.*). However, if your remote application does not have the Application Links plugin installed and you are configuring the IP Patterns in the remote application (not the Application Links plugin), you must not leave this field blank nor use *.*.*.*. Failure to configure IP address restrictions in this scenario is a security vulnerability, allowing an unknown site to log into your site under a user's login ID.
     Consider the following scenarios, if you want to limit access by using this field:
     • If the remote application is using a proxy server, you need to add the proxy server's IP address to this field.
     • If the remote application is a clustered instance of Confluence, you need to accept requests from each cluster node. If you do not specify each node's address, Confluence users may not be able to view any data from your application. You can set this up by either specifying each individual IP address for each node of the cluster (e.g. 172.16.0.10, 172.16.0.11, 172.16.0.12), or specifying the IP address for your clustered Confluence instance using wildcards (e.g. 172.16.0.*).
   • 'URL Patterns' — Enter the local URLs that the remote application will be allowed to access. Each URL corresponds to a particular application function. Enter one URL per line, as follows:
     • If your local application is JIRA, enter the following URL Patterns — /plugins/servlet/streams, /sr/jira.issueviews:searchrequest, /secure/RunPortlet, /rest, /rpc/soap
     • If your local application is Confluence, enter the following URL Patterns — /plugins/servlet/streams, /plugins/servlet/applinks/whoami
   • 'Certificate Timeout (ms)' — Enter the certificate timeout. The default is 10 seconds. The certificate timeout is used to prevent replay attacks. For example, if a Trusted Apps request is intercepted and (maliciously) re-sent, the application will be able to check when the request was first sent. If the second request is sent more than 10 seconds (or whatever the certificate timeout is set to) after the initial request, it will be rejected. Please note, you should not have to change the default value of this field for most application links. Note that the certificate timeout relies on the clocks on both servers being synchronised.
5. Click the 'Apply' button to save your changes.