Yes, our API endpoints have to be triggered from a Server-to-Server connection. Your server/ software/ application must be able to:

1.  Support the following protocols: HTTP/2, TLS 1.2/1.3, and 
2.  Trigger HTTP/GET and HTTP/POST requests.

A Callback URL is also required to redirect users to the payroll software after Corppass login and consent. The Callback URL must use a Fully Qualified Domain Name (FQDN), and meet all of the following requirements:

1.  Must be able to accept parameters, 
2.  Must not contain IP address, port number, Hash (#) or Wildcard (*) characters, and
3.  Must not be the same URL for sandbox and production environments.

This information is sourced from IRAS.