Building a FreshlyCart Integration

Application access is approval-controlled while the platform is in controlled Beta. Self-service app registration is not available.

1. Request access with the integration use case, redirect URIs, required resource families, and testing plan.
2. Register the application through FreshlyCart and request only minimum scopes.
3. Implement Authorization Code + PKCE S256, rotating refresh tokens, revoke/reconnect, and exact audience handling.
4. Respect explicit location grants, cursor pagination, idempotency, retry limits, event retention, and reconciliation.
5. Test tenant isolation, grant narrowing, duplicate delivery, ambiguous write results, throttling, cursor expiry, and recovery before approval.

Do not store tokens in browser clients or URLs. Keep credentials encrypted, redact logs, retain request IDs, and use synthetic test data.