Skip to content
FreshlyFreshlyCart Developers

OAuth 2.0 + PKCE

FreshlyCart uses Authorization Code with PKCE S256. Applications are provisioned and approved by FreshlyCart during controlled Beta; self-service registration is unavailable.

  1. Register exact redirect URIs. HTTPS is required except for approved local callbacks; wildcards and fragments are rejected.
  2. Generate a random 43–128-character PKCE verifier, its S256 challenge, and an opaque state.
  3. Redirect the merchant owner to /oauth/authorize with response_type=code, client_id, exact redirect_uri, scope, state, challenge fields, and the configured REST resource audience.
  4. Compare the returned state, then exchange the one-time code within five minutes at /oauth/token.
  5. Send the opaque 15-minute access token as a Bearer token. Rotate the refresh token on every refresh.

The merchant owner approves scopes and explicit location grants. Reauthorization replaces the installation’s entire grant and invalidates its outstanding credentials. A caller never chooses a merchant.

Reusing an already rotated refresh token revokes that refresh family and its active access tokens. /oauth/revoke is idempotent. REST access tokens are audience-bound and do not authorize a future MCP resource.