[28 July 2026] Review Your Integration Before Re-deployment of `iss` Parameter Rollout

Dear Partners,

We are writing to inform you that the deployment of the `iss` parameter on the Corppass Authorization endpoint on 23 July 2026 was rolled back after production issues were observed with several partner integrations.

As previously communicated, the change introduced an additional `iss` query parameter in the Authorization endpoint callback response for both the Legacy API and Financial-grade API (FAPI) 2.0 integration flows, in line with OAuth 2.0 security best practices.

Following deployment, we identified several e-services whose integrations were not compatible with the additional `iss` parameter, impacting users' login experience. To minimise service disruption, the change was rolled back.

We will re-deploy this enhancement on 11 August 2026. All partners are required to review and test their integrations before the production rollout. 

Action Required

As part of this change, the authorization response will include an additional `iss` query parameter in the callback URL, in accordance with RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification). The OpenID Provider (OP) discovery document will also advertise "authorization_response_iss_parameter_supported": true.

Please review your implementation and ensure that:

• Your callback endpoint accepts the additional `iss` query parameter.
• Your application passes the complete authorization response (or at least all callback parameters, including `code`, `state`, and `iss`) to your OpenID Connect client library without filtering or reconstructing the callback parameters.
• Any callback parameter validation, URL rewriting, reverse proxies, API gateways, or WAF rules do not remove or reject the `iss` parameter.

If your application uses an OpenID Connect client library that consumes the OP discovery metadata, it may validate the `iss` value in the authorization response against the issuer advertised in the discovery document. If the `iss` parameter is missing or does not match the configured issuer, the authorization response may be rejected before the token exchange. Applications that currently pass only selected callback parameters (for example, `code` and `state`) to the OpenID Connect client library may also need to be updated.

We strongly recommend testing your integration in the Staging environment, where this change is already available, to ensure your application is ready before the production rollout.

If you require additional assistance, please contact our support team here so that we can provide the necessary support.

Thank you for your continued support and partnership.

Best regards,
Corppass Team