OAuth 2.0

Register a client

Open the developer portal → Submit app. Define redirect URIs and scopes. After HQ approval, distribute the install link to merchants.

Authorization code flow

Redirect merchants to POST /oauth/authorize with client_id, redirect_uri, scope, and state. Exchange the code at POST /oauth/token.

POST /api/v1/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "auth_code_from_redirect",
  "redirect_uri": "https://your.app/oauth/callback",
  "client_id": "mrc_…",
  "client_secret": "mcs_…"
}

Refresh tokens

Use grant_type refresh_token before access tokens expire. Revoke compromised tokens with POST /oauth/revoke.

OAuth routes (canonical)

POST /oauth/authorize POST /oauth/token POST /oauth/revoke refresh grant: refresh_token