{"id":851,"date":"2024-01-15T13:58:09","date_gmt":"2024-01-15T13:58:09","guid":{"rendered":"https:\/\/olxdoc.wpenginepowered.com\/?p=851"},"modified":"2024-01-29T10:05:13","modified_gmt":"2024-01-29T10:05:13","slug":"grant-type-authorization_code","status":"publish","type":"post","link":"https:\/\/doc.olxgroup.com\/api\/?p=851","title":{"rendered":"Grant type: authorization_code"},"content":{"rendered":"\r\n

Grant type: authorization_code<\/h2>\r\n

Client must specify Callback URL. You can specify more than one Callback URL. Please avoid special chars like &<\/strong>\u00a0(multiple), #<\/strong>\u00a0in Callback URL.<\/p>\r\n

Flow:<\/strong><\/p>\r\n

On Application site user clicks on button “Authenticate with OLX”.<\/p>\r\n

Auth URL: \/oauth\/authorize\/?client_id=XXX&response_type=code&state=XXX&scope=read write v2&redirect_uri=XXX<\/p>\r\n

Parameter state<\/strong>\u00a0is optional. It will be returned in step 4 so application can validate if response is not crafted by someone else.<\/p>\r\n

Parameter redirect_uri<\/strong> is optional if you specified only one Callback URL. If you have more than one Callback URL parameter redirect_uri<\/strong> is mandatory. Please avoid special chars like &<\/strong> (multiple), #<\/strong>\u00a0in redirect_uri.<\/p>\r\n

URL will be used in step 4. redirect_uri<\/strong>\u00a0should base on defined earlier Callback URL.<\/p>\r\n

Example:<\/p>\r\n

Callback URL:\u00a0http:\/\/myadomain.com\/auth\/connect<\/a><\/p>\r\n

Auth URL:\u00a0https:\/\/www.olx.ro\/oauth\/authorize\/?client_id=123&response_type=code&state=x93ld3v&scope=read+write+v2&redirect_uri=http:\/\/myadomain.com\/auth\/connect<\/a><\/p>\r\n

Example 2:<\/p>\r\n

Callback URL:\u00a0http:\/\/myadomain.com\/auth\/connect<\/a><\/p>\r\n

Auth URL:\u00a0https:\/\/www.olx.ro\/oauth\/authorize\/?client_id=123&response_type=code&state=x93ld3v&scope=read+write+v2<\/a><\/p>\r\n

If you have only one Callback URL you don’t have to pass redirect_uri<\/strong>\u00a0parameter.<\/p>\r\n

User is redirected to OLX login screen User logs in and authorize client User is redirected back to redirect_uri<\/strong> with some additional query parameters: code<\/strong> and state<\/strong>\u00a0(optional).<\/p>\r\n

Example:\u00a0http:\/\/myadomain.com\/auth\/connect?code=d34feg43g456g&state=x93ld3v<\/a><\/p>\r\n

Application exchange received code<\/strong> to access token by grant type authorization_code<\/strong>.<\/p>\r\n

Request to get access token, sent to \/api\/open\/oauth\/token<\/strong>\u00a0endpoint, should have:<\/p>\r\n

{\r\n \"grant_type\" : \"authorization_code\",\r\n \"client_id\" : \"\",\r\n \"client_secret\" : \"\",\r\n \"code\" : \"\",\r\n \"scope\" : \"v2 read write\",\r\n \"redirect_uri\" : \"http:\/\/myadomain.com\/auth\/connect\"\r\n}\t\t\t<\/code>