Getting started

Documentation for all public and administrative Storefront APIs.

Note: Please check API Reference tab to see all the available storefront APIs.

Authentication

We use the OAuth 2.0 Authorization Framework to authenticate requests. When your Storefront account is provisioned, you will receive a pair of YOUR_CLIENT_ID and YOUR_CLIENT_SECRET that you need to keep for yourself. You use the YOUR_CLIENT_ID and YOUR_CLIENT_SECRET to authenticate yourself to Storefront, and receive an access token in exchange. That access token must be used in every API call you send.

caution

Never share your YOUR_CLIENT_SECRET!

note

Access tokens are short-lived, meaning: they expire within minutes. Once an access token expires, simply request a new access token by method described below.

User-Scoped and Tenant-Scoped Clients

There are two types of clients. User-scoped clients are always assigned to an individual user. Tenant-scoped clients can be used to execute an API request on behalf of another user.

A user-scoped client is required for APIs that require elevated permissions such as creating new catalogs or modifying vendors. For example, the Admin API requires a user-scoped client.

A tenant-scoped client can be used for APIs that are typically executed by a machine on behalf of a user. An example is to search for a product on behalf of some shopper. It would simply not be suitable to issue a client for each user, especially for organizations with thousands of users.

Tenant-scoped clients typically allow to pass the email address for which the request should be executed. Please refer to the actual documentation if and how a user-scoped or a tenant-scoped client are permitted.

Issuing an Access Token

There are 4 ways to get the access token and they are as follows.

1. Using authorization code

Step 1 - Get code by calling oauth/authorize API as follows

Examples

cURL
JavaScript
C#
Java
Go

curl --location '<your domain>/oauth/authorize' \
--form 'response_type="code"' \
--form 'client_id="c6b39d0c-45e0-4917-bf37-27590918cb29"' \
--form 'email="user@storefront.run"' \
--form 'redirect_uri="<your redirect uri>"'

var formdata = new FormData();
formdata.append("response_type", "code");
formdata.append("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29");
formdata.append("email", "user@storefront.run");
formdata.append("redirect_uri", "<your redirect uri>");

var requestOptions = {
  method: "POST",
  body: formdata,
  redirect: "follow",
};

fetch("<your domain>/oauth/authorize", requestOptions)
  .then((response) => response.text())
  .then((result) => console.log(result))
  .catch((error) => console.log("error", error));

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "<your domain>/oauth/authorize");
var content = new MultipartFormDataContent();
content.Add(new StringContent("code"), "response_type");
content.Add(new StringContent("c6b39d0c-45e0-4917-bf37-27590918cb29"), "client_id");
content.Add(new StringContent("user@storefront.run"), "email");
content.Add(new StringContent("<your redirect uri>"), "redirect_uri");
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("text/plain");
RequestBody body = new MultipartBody.Builder().setType(MultipartBody.FORM)
  .addFormDataPart("response_type","code")
  .addFormDataPart("client_id","c6b39d0c-45e0-4917-bf37-27590918cb29")
  .addFormDataPart("email","user@storefront.run")
  .addFormDataPart("redirect_uri","<your redirect uri>")
  .build();
Request request = new Request.Builder()
  .url("<your domain>/oauth/authorize")
  .method("POST", body)
  .build();
Response response = client.newCall(request).execute();

package main

import (
  "fmt"
  "bytes"
  "mime/multipart"
  "net/http"
  "io/ioutil"
)

func main() {

  url := "<your domain>/oauth/authorize"
  method := "POST"

  payload := &bytes.Buffer{}
  writer := multipart.NewWriter(payload)
  _ = writer.WriteField("response_type", "code")
  _ = writer.WriteField("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29")
  _ = writer.WriteField("email", "user@storefront.run")
  _ = writer.WriteField("redirect_uri", "<your redirect uri>")
  err := writer.Close()
  if err != nil {
    fmt.Println(err)
    return
  }


  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Set("Content-Type", writer.FormDataContentType())
  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := ioutil.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

Parameters

Parameter	Description
`response_type`	Set this to `code` to get authorization code in return.
`client_id`	Your Storefront Client ID. You can find this in the settings tab of your account.
`email`	Only required if the Client is tenant-scoped.

Response

If everything goes well, you will be redirected to redirect uri with code and state params

{
  "code": "eJh62MC2n7dHp....dRKkiFvWDrYmDW1Y",
  "state": ""
}

Errors

In case of an error, you can use the HTTP status code and the response body to find out what went wrong.

HTTP Status Code	Description
`400 Bad Request`	The server understood your request but is unable to complete it, e.g. because a required parameter is missing.
`401 Unauthorized`	You sent invalid credentials.
`500 Internal Server Error`	Something went wrong on our side.

The HTTP response body if formatted according to the OAuth 2.0 Specification Section 5.2.

Example:

{
  "error": "invalid_request",
  "error_description": "Invalid request"
}

Step 2 - Get access_token by calling oauth/token API as follows

Examples

cURL
JavaScript
C#
Java
Go

curl --location '<your domain>/oauth/token' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'client_id=c6b39d0c-45e0-4917-bf37-27590918cb29' \
--data-urlencode 'code=c1negPySlEqKBNlFsKxCOPaM_GA3e4-MPvx0Y7kAj6HabjQimP-rIJoP16EO0_FU' \
--data-urlencode 'redirect_uri=<your domain>'

var urlencoded = new URLSearchParams();
urlencoded.append("grant_type", "authorization_code");
urlencoded.append("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29");
urlencoded.append(
  "code",
  "c1negPySlEqKBNlFsKxCOPaM_GA3e4-MPvx0Y7kAj6HabjQimP-rIJoP16EO0_FU"
);
urlencoded.append("redirect_uri", "<your domain>");

var requestOptions = {
  method: "POST",
  body: urlencoded,
  redirect: "follow",
};

fetch("<your domain>/oauth/token", requestOptions)
  .then((response) => response.text())
  .then((result) => console.log(result))
  .catch((error) => console.log("error", error));

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "<your domain>/oauth/token");
var collection = new List<KeyValuePair<string, string>>();
collection.Add(new("grant_type", "authorization_code"));
collection.Add(new("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29"));
collection.Add(new("code", "c1negPySlEqKBNlFsKxCOPaM_GA3e4-MPvx0Y7kAj6HabjQimP-rIJoP16EO0_FU"));
collection.Add(new("redirect_uri", "<your domain>"));
var content = new FormUrlEncodedContent(collection);
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("text/plain");
RequestBody body = RequestBody.create(mediaType, "grant_type=authorization_code&client_id=c6b39d0c-45e0-4917-bf37-27590918cb29&code=c1negPySlEqKBNlFsKxCOPaM_GA3e4-MPvx0Y7kAj6HabjQimP-rIJoP16EO0_FU&redirect_uri=<your domain>");
Request request = new Request.Builder()
  .url("<your domain>/oauth/token")
  .method("POST", body)
  .build();
Response response = client.newCall(request).execute();

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {

  url := "<your domain>/oauth/token"
  method := "POST"

  payload := strings.NewReader("grant_type=authorization_code&client_id=c6b39d0c-45e0-4917-bf37-27590918cb29&code=c1negPySlEqKBNlFsKxCOPaM_GA3e4-MPvx0Y7kAj6HabjQimP-rIJoP16EO0_FU&redirect_uri=https%3A%2F%2Fdemo.storefront.local")

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := ioutil.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

Parameters

Parameter	Description
`grant_type`	Set this to `authorization_code` to get access token code in return using code.
`client_id`	Your Storefront Client ID. You can find this in the settings tab of your account.
`code`	Pass the code that we received in step-1.
`redirect_uril`	Redirect uri

Response

If everything goes well, you will receive the access token in response.

{
  "access_token": "wwHIT96o-D5gkH2t0i7s....ONChtZ6R0d_Ww-LhAk",
  "token_type": "bearer",
  "expires_in": 899,
  "refresh_token": "PeBKxIP-Th-xG2Pbwyx4mo....gHUFAV-uD-W4EEU9bCLWsWiMC"
}

Errors

In case of an error, you can use the HTTP status code and the response body to find out what went wrong.

HTTP Status Code	Description
`400 Bad Request`	The server understood your request but is unable to complete it, e.g. because a required parameter is missing.
`401 Unauthorized`	You sent invalid credentials.
`500 Internal Server Error`	Something went wrong on our side.

The HTTP response body if formatted according to the OAuth 2.0 Specification Section 5.2.

Example:

{
  "error": "invalid_request",
  "error_description": "Invalid request"
}

2. Using client credentials

To get access token using client credentials, call the oauth/token api as follows

Examples

cURL
JavaScript
C#
Java
Go

curl --location '<your domain>/oauth/token' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=c6b39d0c-45e0-4917-bf37-27590918cb29' \
--data-urlencode 'client_secret=TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z'

var urlencoded = new URLSearchParams();
urlencoded.append("grant_type", "client_credentials");
urlencoded.append("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29");
urlencoded.append(
  "client_secret",
  "TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z"
);

var requestOptions = {
  method: "POST",
  body: urlencoded,
  redirect: "follow",
};

fetch("<your domain>/oauth/token", requestOptions)
  .then((response) => response.text())
  .then((result) => console.log(result))
  .catch((error) => console.log("error", error));

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "<your domain>/oauth/token");
var collection = new List<KeyValuePair<string, string>>();
collection.Add(new("grant_type", "client_credentials"));
collection.Add(new("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29"));
collection.Add(new("client_secret", "TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z"));
var content = new FormUrlEncodedContent(collection);
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("text/plain");
RequestBody body = RequestBody.create(mediaType, "grant_type=client_credentials&client_id=c6b39d0c-45e0-4917-bf37-27590918cb29&client_secret=TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z");
Request request = new Request.Builder()
  .url("<your domain>/oauth/token")
  .method("POST", body)
  .build();
Response response = client.newCall(request).execute();

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {

  url := "<your domain>/oauth/token"
  method := "POST"

  payload := strings.NewReader("grant_type=client_credentials&client_id=c6b39d0c-45e0-4917-bf37-27590918cb29&client_secret=TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z")

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := ioutil.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

Parameters

Parameter	Description
`grant_type`	Set this to `client_credentials` to get access token code.
`client_id`	Your Storefront Client ID. You can find this in the settings tab of your account.
`client_secret`	Your storefront client secret

note

The above params can be passed in json body as well. client_id and client_secret can be passed in Authorization header Basic <base64 encode value of client_id:client_secret>

Response

If everything goes well, you will receive the access token in response.

{
  "access_token": "wwHIT96o-D5gkH2t0i7s....ONChtZ6R0d_Ww-LhAk",
  "token_type": "bearer",
  "expires_in": 899
}

Errors

In case of an error, you can use the HTTP status code and the response body to find out what went wrong.

HTTP Status Code	Description
`400 Bad Request`	The server understood your request but is unable to complete it, e.g. because a required parameter is missing.
`401 Unauthorized`	You sent invalid credentials.
`500 Internal Server Error`	Something went wrong on our side.

The HTTP response body if formatted according to the OAuth 2.0 Specification Section 5.2.

Example:

{
  "error": "invalid_request",
  "error_description": "Invalid request"
}

3. Using JWT token

To get access token using JWT token, first need to create a JWT token using follwing parameters -

Algorithm - HS256
Payload

{
  "sub": "email@storefront.run", // user email
  "iss": "c6b39d0c-45e0-4917-bf37-27590918cb29", // storefront client id
  "name": "username", // username
  "iat": 1708072005, // created at
  "view": "external_view"
}

User client_secret to add the signature. Check jwt.io for more details.
You have the encoded token which can be passed to the /oauth/token api to get the access token as follows
The view can be either not passed(nil - consider user's view) or ""(empty - consider tenant's default view) or external view ID(consider input passed view).

Examples

cURL
JavaScript
C#
Java
Go

curl --location '<your domain>/oauth/token' \
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer' \
--data-urlencode 'assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyb290QHN0b3JlZnJvbnQucnVuIiwiaXNzIjoiYzZiMzlkMGMtNDVlMC00OTE3LWJmMzctMjc1OTA5MThjYjI5IiwibmFtZSI6InJvb3QiLCJpYXQiOjE3MDgwNzIwMDV9.JaFkajBD1_mLQPYnLZYny8aeYr3Y_S7qy6eBqnQamjU'

var urlencoded = new URLSearchParams();
urlencoded.append("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
urlencoded.append(
  "assertion",
  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyb290QHN0b3JlZnJvbnQucnVuIiwiaXNzIjoiYzZiMzlkMGMtNDVlMC00OTE3LWJmMzctMjc1OTA5MThjYjI5IiwibmFtZSI6InJvb3QiLCJpYXQiOjE3MDgwNzIwMDV9.JaFkajBD1_mLQPYnLZYny8aeYr3Y_S7qy6eBqnQamjU"
);

var requestOptions = {
  method: "POST",
  body: urlencoded,
  redirect: "follow",
};

fetch("<your domain>/oauth/token", requestOptions)
  .then((response) => response.text())
  .then((result) => console.log(result))
  .catch((error) => console.log("error", error));

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "<your domain>/oauth/token");
var collection = new List<KeyValuePair<string, string>>();
collection.Add(new("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"));
collection.Add(new("assertion", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyb290QHN0b3JlZnJvbnQucnVuIiwiaXNzIjoiYzZiMzlkMGMtNDVlMC00OTE3LWJmMzctMjc1OTA5MThjYjI5IiwibmFtZSI6InJvb3QiLCJpYXQiOjE3MDgwNzIwMDV9.JaFkajBD1_mLQPYnLZYny8aeYr3Y_S7qy6eBqnQamjU"));
var content = new FormUrlEncodedContent(collection);
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("text/plain");
RequestBody body = RequestBody.create(mediaType, "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyb290QHN0b3JlZnJvbnQucnVuIiwiaXNzIjoiYzZiMzlkMGMtNDVlMC00OTE3LWJmMzctMjc1OTA5MThjYjI5IiwibmFtZSI6InJvb3QiLCJpYXQiOjE3MDgwNzIwMDV9.JaFkajBD1_mLQPYnLZYny8aeYr3Y_S7qy6eBqnQamjU");
Request request = new Request.Builder()
  .url("<your domain>/oauth/token")
  .method("POST", body)
  .build();
Response response = client.newCall(request).execute();

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {

  url := "<your domain>/oauth/token"
  method := "POST"

  payload := strings.NewReader("grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyb290QHN0b3JlZnJvbnQucnVuIiwiaXNzIjoiYzZiMzlkMGMtNDVlMC00OTE3LWJmMzctMjc1OTA5MThjYjI5IiwibmFtZSI6InJvb3QiLCJpYXQiOjE3MDgwNzIwMDV9.JaFkajBD1_mLQPYnLZYny8aeYr3Y_S7qy6eBqnQamjU")

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := ioutil.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

Parameters

Parameter	Description
`grant_type`	Set this to `urn:ietf:params:oauth:grant-type:jwt-bearer` to get access token code.
`assertion`	JWT token created using above mentioned steps

Response

If everything goes well, you will receive the access token in response.

{
  "access_token": "sJOTniniSo6XO7....enbrh7nBJd6bMo1DsuVMz",
  "token_type": "bearer",
  "id_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3Mi.......JcF0ey4MuhQLE",
  "expires_in": 899
}

Errors

In case of an error, you can use the HTTP status code and the response body to find out what went wrong.

HTTP Status Code	Description
`400 Bad Request`	The server understood your request but is unable to complete it, e.g. because a required parameter is missing.
`401 Unauthorized`	You sent invalid credentials.
`500 Internal Server Error`	Something went wrong on our side.

The HTTP response body if formatted according to the OAuth 2.0 Specification Section 5.2.

Example:

{
  "error": "invalid_request",
  "error_description": "Invalid request"
}

4. Using refresh token

The refresh token received in the response in the method 1(using authorization code) can be used to get the access token as follows

Examples

cURL
JavaScript
C#
Java
Go

curl --location '<your domain>/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=eww5FRYG2m990xXW9K9VamCwNEJ1JyUIWVRfkLOXOK7jFC-BzwPtEH3ya4jQiKvW' \
--data-urlencode 'client_id=c6b39d0c-45e0-4917-bf37-27590918cb29' \
--data-urlencode 'client_secret=TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z'

var myHeaders = new Headers();
myHeaders.append("Content-Type", "application/x-www-form-urlencoded");
myHeaders.append("Cookie", "csrf_token=");

var urlencoded = new URLSearchParams();
urlencoded.append("grant_type", "refresh_token");
urlencoded.append(
  "refresh_token",
  "eww5FRYG2m990xXW9K9VamCwNEJ1JyUIWVRfkLOXOK7jFC-BzwPtEH3ya4jQiKvW"
);
urlencoded.append("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29");
urlencoded.append(
  "client_secret",
  "TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z"
);

var requestOptions = {
  method: "POST",
  headers: myHeaders,
  body: urlencoded,
  redirect: "follow",
};

fetch("<your domain>/oauth/token", requestOptions)
  .then((response) => response.text())
  .then((result) => console.log(result))
  .catch((error) => console.log("error", error));

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "<your domain>/oauth/token");
request.Headers.Add("Cookie", "csrf_token=");
var collection = new List<KeyValuePair<string, string>>();
collection.Add(new("grant_type", "refresh_token"));
collection.Add(new("refresh_token", "eww5FRYG2m990xXW9K9VamCwNEJ1JyUIWVRfkLOXOK7jFC-BzwPtEH3ya4jQiKvW"));
collection.Add(new("client_id", "c6b39d0c-45e0-4917-bf37-27590918cb29"));
collection.Add(new("client_secret", "TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z"));
var content = new FormUrlEncodedContent(collection);
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/x-www-form-urlencoded");
RequestBody body = RequestBody.create(mediaType, "grant_type=refresh_token&refresh_token=eww5FRYG2m990xXW9K9VamCwNEJ1JyUIWVRfkLOXOK7jFC-BzwPtEH3ya4jQiKvW&client_id=c6b39d0c-45e0-4917-bf37-27590918cb29&client_secret=TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z");
Request request = new Request.Builder()
  .url("<your domain>/oauth/token")
  .method("POST", body)
  .addHeader("Content-Type", "application/x-www-form-urlencoded")
  .addHeader("Cookie", "csrf_token=")
  .build();
Response response = client.newCall(request).execute();

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {

  url := "<your domain>/oauth/token"
  method := "POST"

  payload := strings.NewReader("grant_type=refresh_token&refresh_token=eww5FRYG2m990xXW9K9VamCwNEJ1JyUIWVRfkLOXOK7jFC-BzwPtEH3ya4jQiKvW&client_id=c6b39d0c-45e0-4917-bf37-27590918cb29&client_secret=TTR2P4ES6cpfB2to4L6G4m2xzBm695hhMh1rg93B0DxKMNiw9n7aa9LU7316u68Z")

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
  req.Header.Add("Cookie", "csrf_token=")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := ioutil.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

Parameters

Parameter	Description
`grant_type`	Set this to `refresh_token` to get access token code.
`refresh_token`	Refresh token received in the response when you got the access token
`client_id`	Your Storefront Client ID. You can find this in the settings tab of your account.
`client_secret`	Your storefront client secret

note

client_id and client_secret can be passed in Authorization header Basic <base64 encode value of client_id:client_secret>

Response

If everything goes well, you will receive the access token in response.

{
  "access_token": "zwV_jKipfJfVlKO6vLUWm...711B0L_dL",
  "token_type": "bearer",
  "expires_in": 899,
  "refresh_token": "eww5FRYG2m990xXW9K9VamCw...BzwPtEH3ya4jQiKvW"
}

Errors

In case of an error, you can use the HTTP status code and the response body to find out what went wrong.

HTTP Status Code	Description
`400 Bad Request`	The server understood your request but is unable to complete it, e.g. because a required parameter is missing.
`401 Unauthorized`	You sent invalid credentials.
`500 Internal Server Error`	Something went wrong on our side.

The HTTP response body if formatted according to the OAuth 2.0 Specification Section 5.2.

Example:

{
  "error": "invalid_request",
  "error_description": "Invalid request"
}

Getting started

Authentication​

User-Scoped and Tenant-Scoped Clients​

Issuing an Access Token​

1. Using authorization code​

Examples​

Parameters​

Response​

Errors​

Examples​

Parameters​

Response​

Errors​

2. Using client credentials​

Examples​

Parameters​

Response​

Errors​

3. Using JWT token​

Examples​

Parameters​

Response​

Errors​

4. Using refresh token​

Examples​

Parameters​

Response​

Errors​

Authentication

User-Scoped and Tenant-Scoped Clients

Issuing an Access Token

1. Using authorization code

Examples

Parameters

Response

Errors

Examples

Parameters

Response

Errors

2. Using client credentials

Examples

Parameters

Response

Errors

3. Using JWT token

Examples

Parameters

Response

Errors

4. Using refresh token

Examples

Parameters

Response

Errors