StoreBay Developers
Oauth

OAuth2 authorization endpoint

Starts the authorization-code + PKCE flow for marketplace apps acting on behalf of an operator. On approval, redirects to `redirect_uri` with a short-lived `code` (and the `state`). PKCE (`S256`) is required.

GET
/oauth/authorize

Starts the authorization-code + PKCE flow for marketplace apps acting on behalf of an operator. On approval, redirects to redirect_uri with a short-lived code (and the state). PKCE (S256) is required.

Query Parameters

response_type*"code"

Must be code.

Value in

  • "code"
client_id*string
redirect_uri*string
Formaturi
scope?string

Space-delimited scopes requested.

state?string

Opaque value echoed back to defend against CSRF.

code_challenge*string

PKCE code challenge.

code_challenge_method*"S256"

Must be S256.

Value in

  • "S256"

Response Body

application/json

curl -X GET "https://example.com/oauth/authorize?response_type=code&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_challenge=string&code_challenge_method=S256"
Empty
{  "error": "invalid_grant",  "error_description": "string"}

Update an integration connection PATCH

Previous Page

OAuth2 token endpoint POST

Issues an access token. Supports `client_credentials` (an operator's own backend), `authorization_code` + PKCE (marketplace apps; 2-hour access tokens, rotating refresh tokens), and `refresh_token`. Client authenticates with `client_id`/`client_secret`. See conventions.md.