← Developers

OAuth

1. Merchant creates an app in /dashboard/developer and copies Client ID / Secret.
2. Redirect the merchant to /oauth/authorize with client_id, redirect_uri, response_type=code, scope, and PKCE (code_challenge S256).
3. Merchant signs in and authorizes scopes for their store.
4. Exchange the code at POST /api/oauth/token (grant_type=authorization_code).
5. Refresh with grant_type=refresh_token (rotation enabled). Revoke via POST /api/oauth/revoke.