---
api: '[PREVIEW] Revolut Wallet Loyalty Callbacks'
---

# Authorise the customer in the browser

:::warning [Pre-release preview]
This is a pre-release preview of upcoming documentation.
The features, workflows, and UI described here are subject to change before the final release.
:::

Your authorisation endpoint: the `authorization_endpoint` in your discovery document. The
customer's browser (a secure system browser, never an embedded web view) opens it with
the `request_uri` Revolut pushed at `POST /oauth2/par`. Look up the stored request, check
that `client_id` matches the client the `request_uri` was issued to (RFC 9126), and route
the customer by the stored `prompt` value. Route only on `prompt`, never on whether
`enrolment_claims` is empty:

- `prompt=login` (link an existing account): route the customer straight to your sign-in
  screen and force re-authentication, ignoring any existing session. After the customer
  signs in, ask for consent to link their loyalty membership. If the customer has no
  account with you, redirect back with `error=access_denied`.
- `prompt=create` (enrol a new member): pre-fill your registration form with the pushed
  enrolment claims and let the customer register. If the pushed data matches an existing
  membership, offer sign-in and link the account; never create a duplicate.

Show your Terms and Conditions and privacy policy and collect any consent you require.

On completion, redirect back (HTTP 302) to the `redirect_uri` from the stored PAR,
appending `code`, `state`, and `iss` on success, or `error`, `state`, and `iss` on
failure. `iss` is your issuer URL (RFC 9207): Revolut rejects a response whose `iss`
doesn't match the issuer it started the flow with. Bind the membership server-side to
the authorisation code; never put personal data or `member_id` in the redirect URL.

If the `request_uri` is unknown, expired, or already used, there is no stored request and
no `state` to return: redirect to the redirect URI registered for `client_id` with
`error=invalid_request_uri` and `iss`. If no valid redirect URI is known for the
`client_id`, render an error page instead of redirecting.

Reject authorisation requests that bypass `request_uri` (raw OAuth parameters) with `400`,
and render an error page for the customer.

As a browser-facing endpoint, this operation carries no credentials, correlation ID
(`Request-Id`), or API-version header.

## Endpoint

GET `/oauth2/authorize`

## Parameters

### query parameters

- `client_id` (string, required)
  Revolut's OAuth 2.0 client ID, as registered during onboarding.

- `request_uri` (string, required)
  The single-use `request_uri` returned by `POST /oauth2/par`.

## Error responses

| HTTP status code | Description |
| --- | --- |
| 400 | The request bypassed `request_uri` or is otherwise invalid, and no redirect back to Revolut is possible. Render an error page for the customer. |