Yes, our API endpoints have to be triggered from a Server-to-Server connection. Your server/ software/ application must be able to:

1.  Support the following protocols: HTTP/2, TLS 1.2/1.3, and 
2.  Trigger HTTP/GET and HTTP/POST requests.

A Callback URL is also required to redirect users to the payroll software after Corppass login and consent. The Callback URL must use Fully Qualified Domain Name (FDQN), and meet all of the following requirements:

1.  Must be able to accept parameters, 
2.  Must not contain IP address, port number, Hash (#) or Wildcard (*) characters, and
3.  Must not be the same URL for sandbox and production environments.

This information is sourced from IRAS