[31 Aug 2026] Production Rollout of Corppass `iss` Parameter Completed

Dear Partners,

We are writing to confirm that the `iss` parameter change on the Corppass Authorization endpoint has been successfully deployed to the Production environment as of 31 August 2026.

As shared in our previous communication, the Authorization endpoint callback response now includes an additional `iss` query parameter for both the Legacy API and Financial-grade API (FAPI) 2.0 integration flows, in line with OAuth 2.0 security best practices.

What you need to know

If you have already reviewed and tested your integration for this change, no further action is required.

If you encounter authentication issues following the deployment, please verify that:

• Your callback endpoint accepts the additional `iss` query parameter.
• Your application passes the complete authorization response (or at least all callback parameters, including `code`, `state`, and `iss`) to your OpenID Connect client library without filtering or reconstructing the callback parameters.
• Any callback parameter validation, URL rewriting, reverse proxies, API gateways, or WAF rules do not remove or reject the `iss` parameter.

If your application uses an OpenID Connect client library that consumes the OP discovery metadata, ensure the complete authorization response (including `iss`) is passed to the library. Otherwise, the authorization response may be rejected before the token exchange if `iss` is missing or does not match the configured issuer.

If you experience any issues or require assistance following the deployment, please contact our support team here.

Thank you for your cooperation and support in ensuring a smooth rollout.

Best regards,
Corppass Team