Consent flows

Consent flows manage user consent and authorization within the OAuth protocol. They handle the process of requesting, granting, and recording user permissions for accessing protected resources. Consent flows ensure that users explicitly approve the scopes requested by client applications, supporting secure and compliant access control.

Add a consent flow

1. Open the left sidebar and select Visual Identity Orchestrator from the menu.

2. This will display a list of flow categories, select Consent.

3. Press ADD button.

4. Complete the configuration by following the steps described in the add flow section, starting from step 5.

Consent flow components

Consent request

Display what permissions are being requested:

• Clearly explain each scope

• Show which data will be accessed

• Identify the requesting application

• Present risks and implications

User decision

Capture the user's consent decision:

• Allow or deny access

• Select specific permissions (if granular consent is supported)

• Set consent duration or expiration

• Option to remember the decision

Consent recording

Store the consent decision:

• Record granted scopes

• Log timestamp and user identity

• Store for compliance and audit

• Enable future consent review

Consent revocation

Allow users to revoke previously granted consent:

• View active consents

• Revoke individual or all consents

• Notify affected applications

• Clean up associated tokens

Compliance considerations

GDPR requirements

• Freely given: Consent must be voluntary

• Specific: Clearly define what is being consented to

• Informed: Provide complete information

• Unambiguous: Use clear, plain language

• Revocable: Allow users to withdraw consent easily

Best practices

• Use clear, non-technical language

• Avoid pre-checked consent boxes

• Separate consent requests for different purposes

• Provide easy access to privacy policies

• Enable granular consent where appropriate

Use cases

OAuth authorization

• Client application requesting access to user data

• API access on behalf of user

• Third-party service integration

• Delegated authentication

Data processing consent

• Marketing communications

• Data sharing with third parties

• Analytics and tracking

• Profile enrichment

Cookie consent

• Essential cookies

• Analytics cookies

• Marketing cookies

• Third-party cookies

Next steps

• Custom flows

• Library flows

• Design flows