Start here · Step 4

Complete Hosted UnifyID authorization

Create a protected transaction, redirect the person to UnifyID, and let the hosted experience manage authentication, assurance, and consent.

Create the transaction

Generate a new unpredictable state, nonce, PKCE verifier, and S256 challenge for every attempt. Store the transaction on your backend with the initiating browser session and a short expiry.

GET https://api.dev.unifyid.io/v1/oauth/authorize
  ?response_type=code
  &client_id={client_id}
  &redirect_uri={registered_redirect_uri}
  &scope=openid%20email%20identity_verified
  &state={state}
  &nonce={nonce}
  &code_challenge={s256_code_challenge}
  &code_challenge_method=S256

Hosted experience

UnifyID authenticates the account, performs required account-bound assurance, displays the application purpose and requested information, and records the person’s decision.

Callback boundary

Accept only an authorization response associated with the original browser transaction. Validate state with a timing-safe comparison and reject expired, missing, reused, or mismatched transactions.