---
title: Return flow reference
description: Technical details of sending users from your app to a form and back with a response ID.
icon: undo-2
search:
  keywords:
    [return flow, redirect_uri, state, response_id, oauth-like, callback]
---

The return flow is OAuth-shaped but simpler: no client registration and no tokens in the URL. Set it up in the form's settings first. See [Return to your website](/logic/return-to-your-website).

## 1. Send the user to the form

```text
GET https://finerlise.com/f/{form}?redirect_uri={url}&state={state}
```

| Parameter | Required | Rules |
| --- | --- | --- |
| `redirect_uri` | Unless only one URL is allowed | Must exactly match one of the form's **Allowed return URLs** (up to 5, each up to 2,048 characters). Fragments, credentials and non-local `http://` URLs are rejected. |
| `state` | No | Up to 512 characters, with no control characters. Echoed back unchanged. |

If the link is invalid, the respondent sees an error such as _"This form isn't configured to return to that website."_ or _"This return link is invalid."_

## 2. The user returns

After the response is completed, Finerlise redirects to:

```text
{redirect_uri}?response_id={uuid}&state={state}
```

End pages and other redirects are skipped for that submission. **Answers are never included in the URL.**

## 3. Fetch the response

On your server, check that `state` matches what you sent, then read the response with a [Workspace API key](/developers/authentication-api-keys):

```bash
curl https://finerlise.com/api/v1/responses/{response_id} \
  -H "Authorization: Bearer $FINERLISE_API_KEY"
```

The body matches the `data` object of the [`response.completed` webhook](/developers/webhooks-reference).

:::tip Generate a random, single-use `state` per user session and store it server-side. This stops someone pasting another person's `response_id` into your callback. :::