Mifos X Open Banking

Consent relay

If your bank sent you here, you can close this tab and go back to the app.

What this site does

When you approve access or a payment at your bank, the bank sends its answer back to a web address registered by the app. Banks that use the OpenID hybrid flow put that answer in the part of the address after the #, which only your browser can read. This page reads it and hands it straight to the Mifos X Open Banking app on your device.

You approve the request at your bank.
Your bank redirects your browser to /callback/ on this site.
The page passes the answer to the app on your computer, or opens the app on your phone.

What happens to your data

Nothing is stored. There is no server code, database, cookie or analytics here.
The bank's answer is removed from your browser history as soon as it has been read.
The site loads no third-party code, cannot be embedded in another page, and is never cached.
It holds no keys or credentials, so it cannot sign in or make payments on its own.

For developers and reviewers

Redirect URI: https://mifos-x-open-banking-relay.pages.dev/callback/
Source code: openMF/mifos-x-open-banking — relay/ (tests, deploy runbook, security headers)
Check the headers yourself: curl -I https://mifos-x-open-banking-relay.pages.dev/callback/
Forking the app: Deploy your own copy of relay/site/ and register your own URL with your bank — never reuse this one.
Licence: Mozilla Public License 2.0

Report a security issue

Email security-disclosure@mifos.org and follow the security policy. Please don't open a public issue for vulnerabilities.