Are redirect URLs declared in advance?

Declared
The bank compares the URL it receives with those declared at registration, character for character.
Not declared
redirect_uri is optional in the /authorize request.

In STET 1.6.3: Part 1, §3.4.2.3 OAuth2 Authorization Code Grant, p. 26
OpenAPIRegistrationRequest.redirect_uris
Bank side: Exact matching is only possible if the URLs were declared, which requires a registration (OPT-ACC-001).
TPP side: Send exactly the same redirect_uri to /authorize and to /token. state is optional, but the spec recommends it.

The entry as stored

{
  "id": "OPT-OAU-010",
  "edition": "1.6.3",
  "chooser": "both",
  "title": {
    "fr": "URL de redirection déclarées",
    "en": "Declared redirect URLs",
    "es": "URL de redirección declaradas",
    "pt-br": "URLs de redirect declaradas"
  },
  "question": {
    "fr": "Les URL de redirection sont-elles déclarées à l'avance ?",
    "en": "Are redirect URLs declared in advance?",
    "es": "¿Se declaran de antemano las URL de redirección?",
    "pt-br": "As URLs de redirect são declaradas com antecedência?"
  },
  "options": [
    {
      "label": {
        "fr": "Déclarées",
        "en": "Declared",
        "es": "Declaradas",
        "pt-br": "Declaradas"
      },
      "text": {
        "fr": "La banque compare l'URL reçue à celles déclarées à l'enregistrement, à l'identique.",
        "en": "The bank compares the URL it receives with those declared at registration, character for character.",
        "es": "El banco compara la URL recibida con las declaradas en el registro, y exige una coincidencia exacta.",
        "pt-br": "O banco compara a URL recebida com as declaradas no registro, de forma exata."
      }
    },
    {
      "label": {
        "fr": "Non déclarées",
        "en": "Not declared",
        "es": "No declaradas",
        "pt-br": "Não declaradas"
      },
      "text": {
        "fr": "`redirect_uri` est optionnel dans la requête `/authorize`.",
        "en": "`redirect_uri` is optional in the `/authorize` request.",
        "es": "`redirect_uri` es opcional en la petición `/authorize`.",
        "pt-br": "`redirect_uri` é opcional na requisição `/authorize`."
      }
    }
  ],
  "stet": {
    "sections": [
      {
        "part": "framework",
        "section": "3.4.2.3",
        "page": 26
      }
    ],
    "openapi": [
      "registration:RegistrationRequest.redirect_uris"
    ],
    "flows": [],
    "changes": [],
    "remark": null
  },
  "aspsp": {
    "fr": "La comparaison exacte n'est possible que si les URL ont été déclarées, ce qui suppose un enregistrement (OPT-ACC-001).",
    "en": "Exact matching is only possible if the URLs were declared, which requires a registration (OPT-ACC-001).",
    "es": "La comparación exacta solo es posible si las URL se han declarado, lo que supone un registro (OPT-ACC-001).",
    "pt-br": "A comparação exata só é possível se as URLs tiverem sido declaradas, o que pressupõe um registro (OPT-ACC-001)."
  },
  "tpp": {
    "fr": "Envoyer `redirect_uri` à l'identique dans `/authorize` et dans `/token`. `state` est optionnel, mais la spec le recommande.",
    "en": "Send exactly the same `redirect_uri` to `/authorize` and to `/token`. `state` is optional, but the spec recommends it.",
    "es": "Enviar exactamente el mismo `redirect_uri` en `/authorize` y en `/token`. `state` es opcional, pero la especificación lo recomienda.",
    "pt-br": "Enviar `redirect_uri` idêntico em `/authorize` e em `/token`. `state` é opcional, mas a especificação o recomenda."
  },
  "regulation": null,
  "note": null,
  "production": null,
  "verifiedAt": "2026-10-19"
}

All options

The options