From 3c4ca5727d01199064e0ae005b62bed0fd62e2d3 Mon Sep 17 00:00:00 2001 From: Rachel Davey <84862906+Rachel-Codat@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:53:18 +0100 Subject: [PATCH 1/3] Update secure linking "How to get started" section One-time Link URLs are now self-serve via the Portal toggle rather than an account manager request, and the Link SDK path needs CORS settings. Restructures the section into numbered steps to match the format used by the manage connections / reconnect update. Co-Authored-By: Claude Opus 5 (1M context) --- blog/250110-secure-linking.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/blog/250110-secure-linking.md b/blog/250110-secure-linking.md index 08f2814402..cfb4d1a101 100644 --- a/blog/250110-secure-linking.md +++ b/blog/250110-secure-linking.md @@ -30,7 +30,10 @@ All clients who want to have stricter rules around Link URLs sent to their custo ## How to get started? -Contact your Codat account manager with the request to enable one-time Link URLs. Depending on the type of the Link flow you are using, you also need to action the following: +One-time Link URLs are self-serve. To set them up: + +1. **Enable the One-time Link URLs setting** in the [Codat Portal](https://app.codat.io) under **[Settings > Auth flow > Link > Onboarding](https://app.codat.io/settings/link-settings/onboarding)**. +2. **Complete the additional steps for your Link flow**, as described below. #### If using Hosted Link @@ -42,4 +45,10 @@ If you are currently adding query parameters to Link URLs (for example, by appen #### If using Link SDK -To enforce the limited validity of Link URLs using the Link SDK, you need to retrieve an access token for your customer using the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint and pass it when initializing the SDK. This serves as an equivalent to a one-time password appended to a Link URL. +The Link SDK uses an access token instead of an appended one-time password. To set this up: + +1. **Get a company access token.** Retrieve it server-side from the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint (`GET /companies/{companyId}/accessToken`). Tokens are valid for 24 hours and scoped to a single company. +2. **Pass the token to the Link SDK** via the `accessToken` prop when initializing the component. +3. **Register your domain** using the [Set CORS settings](/platform-api#/operations/set-cors-settings) endpoint so the component can make authenticated requests from your site. + +Reach out to your account manager or our support team if you'd like help getting set up. From 5d6b42f7f63002f395419253ec500f14814ffe7d Mon Sep 17 00:00:00 2001 From: Rachel Davey <84862906+Rachel-Codat@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:56:08 +0100 Subject: [PATCH 2/3] Move CORS registration to the first Link SDK step Registering the domain is a prerequisite for the access token to work, so it reads better before the token steps rather than after. Co-Authored-By: Claude Opus 5 (1M context) --- blog/250110-secure-linking.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/blog/250110-secure-linking.md b/blog/250110-secure-linking.md index cfb4d1a101..4f2543552b 100644 --- a/blog/250110-secure-linking.md +++ b/blog/250110-secure-linking.md @@ -47,8 +47,8 @@ If you are currently adding query parameters to Link URLs (for example, by appen The Link SDK uses an access token instead of an appended one-time password. To set this up: -1. **Get a company access token.** Retrieve it server-side from the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint (`GET /companies/{companyId}/accessToken`). Tokens are valid for 24 hours and scoped to a single company. -2. **Pass the token to the Link SDK** via the `accessToken` prop when initializing the component. -3. **Register your domain** using the [Set CORS settings](/platform-api#/operations/set-cors-settings) endpoint so the component can make authenticated requests from your site. +1. **Register your domain** using the [Set CORS settings](/platform-api#/operations/set-cors-settings) endpoint so the component can make authenticated requests from your site. +2. **Get a company access token.** Retrieve it server-side from the [Get company access token](/platform-api#/operations/get-company-access-token) endpoint (`GET /companies/{companyId}/accessToken`). Tokens are valid for 24 hours and scoped to a single company. +3. **Pass the token to the Link SDK** via the `accessToken` prop when initializing the component. Reach out to your account manager or our support team if you'd like help getting set up. From 0379e15784e24966d2b589c63e78c7a5672f33e4 Mon Sep 17 00:00:00 2001 From: Rachel Davey <84862906+Rachel-Codat@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:59:00 +0100 Subject: [PATCH 3/3] Drop self-serve wording from the getting started lead-in Co-Authored-By: Claude Opus 5 (1M context) --- blog/250110-secure-linking.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blog/250110-secure-linking.md b/blog/250110-secure-linking.md index 4f2543552b..84daaae6ad 100644 --- a/blog/250110-secure-linking.md +++ b/blog/250110-secure-linking.md @@ -30,7 +30,7 @@ All clients who want to have stricter rules around Link URLs sent to their custo ## How to get started? -One-time Link URLs are self-serve. To set them up: +To set up one-time Link URLs: 1. **Enable the One-time Link URLs setting** in the [Codat Portal](https://app.codat.io) under **[Settings > Auth flow > Link > Onboarding](https://app.codat.io/settings/link-settings/onboarding)**. 2. **Complete the additional steps for your Link flow**, as described below.