v1auth context
Management return
POST /v1/auth/manage/context — validating a first-party application's return address.
First-party applications (the account console, for instance) send the user to the auth pages for sensitive operations, and the auth pages send them back afterwards. The return address comes from the client, so the server must first confirm it belongs to a registered first-party client — otherwise the auth page is an open redirect sitting on a trusted domain.
Request
| Parameter | Type | Required | Notes |
|---|---|---|---|
return_to | string | ✅ | Return address, 1–2048 chars |
client_id | string | Optional | First-party client identifier, 1–128 chars |
{ "success": true, "return_to": "https://console.example.com/security", "client_id": "console" }Validation rules
| Rule | Notes |
|---|---|
| Exact match first | An address identical to a registered redirect_uri passes immediately |
| Same origin allowed | Same-origin addresses are accepted so a first-party app keeps its own routing |
| Non-https rejected | Loopback addresses excepted |
| Userinfo rejected | Addresses like https://user:pass@host/ are always refused |
This step is not elevated
It only answers "where should we send them", and neither reads nor changes any account data. The actual sensitive operations require step-up at their own endpoints; demanding it here would make users verify their identity before they have even started.
Related
- How step-up works: Session elevation
- Registration rules for redirect addresses: Redirect URIs