00. Redirect to App - general

2AU1.00.05

05

Data holders MUST support Redirect to App in accordance with the Authentication Schedule, and: • Data holders MUST use a single issuer identifier per app. • Data holders MUST only support Authorization Code Flow for Redirect to App authentication. • Data holders MUST support Claimed "https" Scheme URI redirection in accordance with section 7.2 and section 8 of [RFC8252]. • After authentication, the data holder MUST continue the authorisation flow within the data holder app. • Data holders SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.

Security Profile, Authentication Flows, Redirect to App, Data Holders

Authenticate: Redirect to App

22 September 2025