Search code examples
oauth-2.0oauthcsrfplaid

Is there a way of passing a custom csrf_state through the Plaid OAuth flow?


With a standard Oauth client, I can configure custom params passed through the csrf state, i.e. "{org_id}:{service}:{random_characters}"

For Brex, for example, this might look like "org_1:brex:cd8T6tDwuUVWtnOs"

Is there a way of passing custom identifiers like this through the Plaid Oauth flow to be received on the redirect?

Note: I am using Rust and the plaid-rs crate. My link token request code looks like this:

  let client = plaid::PlaidClient::from_env();
  let res = match client
    .link_token_create(LinkTokenCreateRequired {
      client_name: "MyCompany",
      language: "en",
      country_codes: &PLAID_COUNTRY_CODES,
      user: LinkTokenCreateRequestUser {
        client_user_id: user.id.clone(),
        ..Default::default()
      },
    })
    .redirect_uri(format!("{}/oauth2/callback", api_url))
    .products(
      PLAID_PRODUCTS
        .iter()
        .map(|p| p.to_string())
        .collect::<Vec<_>>(),
    )
    .webhook(format!("{}/webhook", api_url))
    .send()
    .await

Solution

  • From conversations with the Plaid dev support team, I think unfortunately the answer is... no.