Skip to content

Update "How to get started" on the secure linking update #1880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Rachel-Codat merged 3 commits into from
Aug 13, 2026
Merged

Update "How to get started" on the secure linking update #1880

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c4ca57
Update secure linking "How to get started" section
Rachel-Codat Aug 13, 2026
5d6b42f
Move CORS registration to the first Link SDK step
Rachel-Codat Aug 13, 2026
0379e15
Drop self-serve wording from the getting started lead-in
Rachel-Codat Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions blog/250110-secure-linking.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,10 @@ All clients who want to have stricter rules around Link URLs sent to their custo

## How to get started?

Contact your Codat account manager with the request to enable one-time Link URLs. Depending on the type of the Link flow you are using, you also need to action the following:
To set up one-time Link URLs:

1. **Enable the One-time Link URLs setting** in the [Codat Portal](https://app.codat.io) under **[Settings > Auth flow > Link > Onboarding](https://app.codat.io/settings/link-settings/onboarding)**.
2. **Complete the additional steps for your Link flow**, as described below.

#### If using Hosted Link

Expand All @@ -42,4 +45,10 @@ If you are currently adding query parameters to Link URLs (for example, by appen

#### If using Link SDK

To enforce the limited validity of Link URLs using the Link SDK, you need to retrieve an access token for your customer using the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint and pass it when initializing the SDK. This serves as an equivalent to a one-time password appended to a Link URL.
The Link SDK uses an access token instead of an appended one-time password. To set this up:

1. **Register your domain** using the [Set CORS settings](/platform-api#/operations/set-cors-settings) endpoint so the component can make authenticated requests from your site.
2. **Get a company access token.** Retrieve it server-side from the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint (`GET /companies/{companyId}/accessToken`). Tokens are valid for 24 hours and scoped to a single company.
3. **Pass the token to the Link SDK** via the `accessToken` prop when initializing the component.

Reach out to your account manager or our support team if you'd like help getting set up.
Loading