# EUR Account Authorization Link

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

The link to the issuer's consent page, where the user lets your app pay out from their EUR account. Called twice: phase 1 gets what to sign, phase 2 the link to open.

## Overview

- The user must have a smart account ([Create the Smart Account](https://docs.aureahub.com/docs/cards-account-deploy.md)). Every phase answers `authUrl`, `redirectUri` and `codeVerifier`; keep `codeVerifier` for [Activate the EUR Account](https://docs.aureahub.com/docs/cards-iban-activate.md).
- `redirectUri` is where the consent page sends the browser back to — an address of the Aurea API, which then sends it on to your app (The Redirect, below). Your app does nothing with it.
- **Always send `redirectScheme`**, your app's URL scheme (lower-case letters, digits, `-` and `.`, starting with a letter): the consent page returns there. Without one, the redirect goes to a default scheme that is not your app's.
- `isTestnet` `true` uses the issuer's test environment.

## Phase 1

- Send `signature`: the `personal_sign` of [Link Message](https://docs.aureahub.com/docs/cards-link-message.md) by the wallet that signed in to the card program. It names the user's address to the issuer; without it Aurea uses the address it knows.
- The answer adds `siweMessage` — a Sign-In with Ethereum message for that address — and, when the smart account is deployed, `safeMessageHash`, `delayModuleAddress` and `linkMessageQueueCalldata`.
- Then: send the transaction `linkMessageQueueCalldata` to `delayModuleAddress` from the wallet (value 0, Gnosis Chain) and keep its hash; sign `siweMessage` and the 32 bytes of `safeMessageHash`, each with `personal_sign`.

## Phase 2

- Send `siweSignature`, and `safeLinkSignature` and `linkMessageTxHash` when you have them, with the same `signature` and `redirectScheme`. The answer's `authUrl` signs the user in on the consent page at once.
- With `linkMessageTxHash`, Aurea completes the queued consent of the smart account once the module's 180-second delay has passed.
- Without phase 2 — a signature the wallet could not make — open phase 1's `authUrl`: the user signs in on the consent page instead.

## The Redirect

Open `authUrl` in a browser view. When the user is done, the browser goes to `redirectUri`, which sends it on to your app:

```text
<redirectScheme>://eur-account-callback?code=<code>&state=<state>
<redirectScheme>://eur-account-callback?error=<error>
```

Send `code` as `consentId`, with `codeVerifier`, to [Activate the EUR Account](https://docs.aureahub.com/docs/cards-iban-activate.md). `error` is the issuer's, or `missing_code`.

## Refusals

- `422`: no smart account yet; your tenant's EUR account access or its consent page is not set up; a phase 2 without its phase 1, or one to start again from phase 1.
- `423`: a freeze stops the user, the wallet or your tenant from signing ([Freezes & Quarantines](https://docs.aureahub.com/docs/guide-freezes.md)).
- [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) `403` until cards are on for your tenant.

## Endpoint

### `GET /v1/gnosis/eur-account/authorize-url`

Authentication: bearer token required.

The consent page link, in two phases.

**Query parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `redirectScheme` | string | no | Your app's URL scheme; always send it |
| `isTestnet` | string | no | `true` for the issuer's test environment |
| `signature` | string | no | The signed link message (phase 1 and 2) |
| `siweSignature` | string | no | The signed `siweMessage` (phase 2) |
| `safeLinkSignature` | string | no | The signed `safeMessageHash` (phase 2) |
| `linkMessageTxHash` | string | no | The hash of the transaction to `delayModuleAddress` (phase 2) |

**Responses**

`200` Phase 1

```json
{
  "authUrl": "https://…",
  "redirectUri": "https://api.aureahub.com/v1/gnosis/…/callback",
  "codeVerifier": "q8V2…",
  "siweMessage": "api.aureahub.com wants you to sign in with your Ethereum account:\n0x2F4b…",
  "safeMessageHash": "0x5c1e…",
  "delayModuleAddress": "0x9e2d…",
  "linkMessageQueueCalldata": "0x…"
}
```

`200` Phase 2

```json
{
  "authUrl": "https://…",
  "redirectUri": "https://api.aureahub.com/v1/gnosis/…/callback",
  "codeVerifier": "q8V2…"
}
```

**Example request**

```bash
curl "https://api.aureahub.com/v1/gnosis/eur-account/authorize-url?redirectScheme=yourapp&signature=0x…" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#cards-iban-authorize