Authentication

Personal API Tokens

Personal API Tokens are for merchant-owned automation and server integrations. A merchant owner creates a named, expiring token with minimum scopes and explicit location grants. The raw fc_pat_ token is shown once, stored hashed, and sent only in the Authorization: Bearer header.

Future locations are not granted automatically. Replace and revoke a token to change its authority.

OAuth 2.0

OAuth is for approved third-party applications. FreshlyCart uses Authorization Code with PKCE S256, exact redirect URIs, 15-minute opaque fc_oat_ access tokens, rotating fc_ort_ refresh tokens, granular scopes, and explicit location grants.

Endpoints are /oauth/authorize, /oauth/token, and /oauth/revoke. OAuth protocol errors use standard error values instead of the Public API error envelope.

Application access and registration are approval-controlled during Beta. See OAuth 2.0 + PKCE.