Live and Sandbox Web OAuth Integration

API Issues
1

We are using a live and sandbox web OAuth integration that has previously worked reliably.

Current behaviour:

  • Our request to /oauth2/authorise succeeds and returns 302.

  • We extract the returned response_headers.redirect_url, which is a Companies House identity journey URL of the form /oauth2/user/choose-your-signin?request=....

  • That URL is then opened immediately for the user to continue login/authorisation.

  • The journey now fails on “Page not found”.

We have verified:

  • client details and registered redirect URI (for both environments),

  • that we have used the correct details for the live and sandbox environments (i.e. we haven’t mixed them up),

  • no apparent mutation of the returned redirect_url between backend receipt and frontend use.

Please can you confirm whether there has been any change to validation, lifetime, or browser/session requirements for the intermediate identity journey URL returned by /oauth2/authorise, or whether there is a current issue affecting these URLs in live.

The last test performed using client id 0ab94174-4522-4f54-bd49-a5765eef25bb in live was timed at 2026-04-08 14:40:47.

2

Is there anyone from Companies House that can check the logs for me please? Should only take 2 mins…

3

Not a lot of support from the Companies House development team is there? Appreciate they may be focused on the hardware issue that is plaguing their service right now.

In terms of the issue I reported over two months ago, I found my original applications (that worked for months without any issues) under a different account.

I have since retested with it and Companies House now seems to be forcing the original authorise request to be auto-forwarded within the browser (via the 302 http status code) to the sign-in form and the subsequent authorisation process. I had previously been separating it into two separate requests which was previously working fine and continues to work fine on other Oauth APIs (e.g. Flickr).

So, I’ve changed this to allow the auto redirection and now it reaches the login page, and indeed now I have connected my Companies House account to my One Login account, at times I have been able to run all the way through the logging in process including the verification using a OTP.

But it still ends up on a “Sorry, there is a problem with the service” error page. Right now, as soon as I click on the One Login link, it ends up on this error page.

Can anyone confirm whether there are currently issues with the Oauth2 authentication service?

4

Now sorted and thanks for the support from the Companies House developer team (not)! Through trial and error I now realise you can’t just use the “https://identity.company-information.service.gov.uk/user/profile.read” scope to authorise. You have to provide another permission at the same time. E.g. “https://api.company-information.service.gov.uk/company/xxxxxxxx/registered-office-address.update”.

That makes sense on the basis that the only reason I should be using the oauth2 method for authentication is if I am planning on making changes. If all I am trying to do is read, then I can use the REST api instead.

Thanks for letting me know Companies House! Communicating changes is always a helpful thing to do.