Redirect URIs Explained
Overview
We use the OAuth 2.0 framework to enable fintech applications to obtain access through http to consumer data.
OAuth 2 puts the consumer in control of the authentication workflow. Authentication starts at the fintech or recipient app (the originating application). Consumers must grant permission directly to their banks' authorization servers before the servers send any data back to the application. The system and application never see consumer credentials.
After the authentication process is complete, the financial institution sends the consumer back to the originating application using the system.
The originating application must specify to Akoya where the consumer returns with a redirect URI, also referred to as a callback or a redirection endpoint.
Why Registration is Important
Because the consumer’s financial institution is returning sensitive data, you must register at least one redirect URI for your application in the Data Recipient Hub. This is a security measure which prevents malicious redirects to rogue servers.
After you register your redirect URI(s) in the Data Recipient Hub, you'll receive a client ID and client secret, which you'll use to authenticate when requesting tokens. The client ID is public information; however you should protect it. You must also protect the client secret, as it is effectively the password for your application.
Requirements
You must provide an absolute path for your redirect URI, both when you register it in the Data Recipient Hub and when you include it in your application code.
You can use localhost when testing in sandbox, but you must use https.