Method and system for access authorisation

Abstract

The present invention relates to authorising access to data () associated with a user. Aspects of the invention provide a computer-implemented method, computer software, a system and a computing device. The method comprises receiving, at an application server () from a first device (), a request to access the data () associated with the user. The data () is hosted at a data server () external to the application server (). The application server () provides an authorisation request () to an authorisation server (); and the authorisation request is transmitted from the authorisation server () to an authorisation application () executed on a second device () associated with the user. The authorisation application () executed on the second device () sends, in response to receiving the authorisation request, a redirect authorisation request () to a second application () executed on the second device (), the second application () being associated with the data server (). The request is authorised at the second device () by the second application (), in dependence on an authorisation input from the user at the second device (). In response to the authorisation of the request the second application () provides an access token to the application server () via the authorisation server (), the access token being configured to enable access by the application server () to the data associated with the user.