Origins, redirects, proxies, and environments

Production redirect URIs and browser Origins are exact HTTPS values with no credentials or fragments. Redirect URI matching includes path and registered query semantics. An Origin allowlist enables browser response access; it does not grant an OAuth scope or resource ownership.

A third-party reverse proxy must not display, embed, or imitate the Ayalink sign-in page; collect email, password, or MFA; or forward a global-session Cookie, authorization code, or token. Users sign in only on the official Ayalink authorization domain. The third party receives only its own app's minimal, short-lived, revocable grant. Origin, CORS, Host headers, tenant IDs, slugs, and proxy network location grant no authority.

A BFF is same-origin with the third-party application, stores only that application's OAuth grant, and uses an HttpOnly, Secure, appropriately SameSite application-session Cookie. It must not replace the Ayalink authorization server, request an Ayalink password or MFA, forward an Ayalink Cookie to a merchant domain, or infer tenant ownership from Host headers. Server-side grants stay out of browser bundles, URLs, logs, and analytics.

A malicious proxy can use a look-alike domain, TLS termination, and injected scripts to record every account factor. Users should verify the official authorization domain. After suspected phishing, revoke the app/installation grant from an official entry point, sign out, update the password, reconfigure MFA, and report through the official security channel.

Sandbox and production use different clients, installations, secrets, quotas, Webhook endpoints, mappings, intents, and data domains. A sandbox token is rejected by production even if its app and store identifiers look similar.

Environment-managed settings are read-only in Merchant/Admin and show their source. Secret values are displayed once at creation or rotation, then only as masked metadata. A missing encryption key or provider credential fails closed; the UI must not claim the capability is active.

DPoP, refresh-token rotation, token-family replay detection, and the user grant-management entry point are unavailable or pending security review. This page does not claim support for them. API Reference publishes no OAuth endpoint or request/response example before that review completes.