Redirect URI options for native mobile apps

NHS login
1

Hello,

We’re integrating NHS login into a native mobile app (iOS and Android), currently against the sandpit environment.

Our intended flow follows RFC 8252 (OAuth 2.0 for Native Apps): the app opens the NHS login journey in the system browser, receives the authorisation code via the redirect, and passes it to our backend, which performs the token exchange using private_key_jwt — the private key stays server-side at all times.

Could you clarify a few points about redirect URIs for this pattern?

  1. Can a custom URL scheme (e.g. our.app.scheme://callback) be registered as a redirect URI for native app clients, or must redirect URIs be https only?
  2. If https only, is it acceptable for the registered redirect URI to be a backend endpoint that immediately redirects on to the app’s custom scheme, so the code reaches the app within the browser session?
  3. Are the requirements the same in production as in the sandpit, or should we expect stricter rules at onboarding?

If there’s existing guidance for native mobile integrations, a pointer would be much appreciated.

Many thanks,
Yupeng

2

Afternoon Yupeng,

We do allow URLs for both apps and websites.

Sandpit is less restrictive and we allow wild cards for redirect URIs but in Integration and Production we don’t.

3

Thank you Stephen! That’s very helpful.