Claimed HTTPS callbacks
04The operating system can associate a domain’s HTTPS links with its verified app.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7.2 ↗
RFC 8252 · § 7.2EXAMPLE
3 / 3
03
Deliver the response to the associated app.
The app checks its transaction and exchanges the code.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Prefer app-claimed HTTPS where available.
- Native apps SHOULD use claimed HTTPS callbacks over other options when possible.
- The OS associates the destination domain with the application.
- An HTTPS redirect does not make the installed app a confidential client; registration must still record the type.
These callbacks reduce interception risk, but the public client still needs PKCE.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy