Private-use callback schemes
03A domain-based custom URI scheme lets the operating system return a code to an installed app.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7.1 ↗
RFC 8252 · § 7.1EXAMPLE
3 / 3
03
Launch the app with the callback.
The native app validates its pending transaction and redeems the code.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Use a collision-resistant scheme, then still use PKCE.
- The app MUST base its scheme on a domain under its control, expressed in reverse order.
- A callback such as com.example.app:/oauth2redirect uses a private-use scheme.
- Multiple apps may register the same scheme; the scheme alone is not proof of the receiver’s identity.
The extra app interception risk is why choosing a scheme does not replace PKCE.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy