---
url: https://docs.youcan.shop/store-admin/introduction/oauth.md
---
# Connect OAuth

To connect to YouCan API, you can use the standard [OAuth 2](https://oauth.net/2/) to get an access token.

## Prerequisites

Before you begin, ensure you have a Partner Account with YouCan. You can [register here](https://partners.youcan.shop/).

## Setting Up OAuth

Every app owns an OAuth client. The fastest way to create one is the CLI, see [get started](/apps/developer-tools/apps-cli/get-started), then read your credentials with `youcan app env show`. To create an app from the [Partner Dashboard](https://partners.youcan.shop/dashboard/) instead:

* Go to the `Apps` tab in the Partner Dashboard and Click on **Create App**.
* Select `create app manually` under **Using YouCan Partners** > enter an `App name`> click `Create app`.

This will automatically generate the OAuth credentials (`Client ID` and `Client Secret`) for your app, which you can find in the [Apps listing Page](https://partners.youcan.shop/dashboard/apps).

> \[!NOTE]\
> Ensure that the "Embedded" option is set to False under Configuration in the app's **Overview** tab after creation

## Authorization Request

To obtain an authorization code, redirect the seller to YouCan with the following URL:

```
https://seller-area.youcan.shop/admin/oauth/authorize?client_id=<CLIENT-ID>&redirect_uri=https://myapp.com/callback&response_type=code&scope[]=read-orders&scope[]=read-products
```

Request only the [scopes](/store-admin/introduction/oauth-scopes) your app needs. The seller approves them on the authorization screen. When your app later requests scopes the seller did not grant, the seller goes through the authorization screen again; requests covered by the existing grant skip it.

> \[!WARNING]\
> The two OAuth endpoints are on different hosts and use different paths:
>
> * Authorization: `https://seller-area.youcan.shop/admin/oauth/authorize` (include the full `/admin/oauth` path; `/oauth/authorize` is not valid)
> * Token: `https://api.youcan.shop/oauth/token`

## Exchange Code for Access Token

After the seller accepts the request via the authorization popup, they will be redirected to the specified redirect URI (`https://myapp.com/callback`). You can then exchange the authorization code for an access token. Here's an example using Laravel:

```php
Route::get(
    '/callback',
    function (Request $request) {
        // If an error occurred or seller rejected authorization
        if ($request->has('error')) {
            if ($request->get('error') === 'access_denied') {
                return 'You canceled the request';
            }

            return "an error occurred";
        }

        $http = new GuzzleHttp\Client;

        $response = $http->post(
            'https://api.youcan.shop/oauth/token',
            [
                'form_params' => [
                    'grant_type'    => 'authorization_code',
                    'client_id'     => '<CLIENT ID>'
                    'client_secret' => '<CLIENT SECRET>',
                    'redirect_uri'  => 'https://myapp.com/callback',
                    'code'          => $request->get('code'),
                ],
                'http_errors' => false,
            ]
        );

        return json_decode((string)$response->getBody(), true);
    }
);
```

Response:

```json
{
    "token_type": "Bearer",
    "expires_in": 1295999,
    "access_token": "<ACCESS TOKEN>",
    "refresh_token": "<REFRESH TOKEN>"
}
```

## Refresh Token

The `expires_in` field of the token response holds the access token's lifetime in seconds. Refresh it before it expires using the `refresh_token` attribute you got from the response. Here's an example of how to refresh it:

```php
$http = new GuzzleHttp\Client;

$response = $http->post(
    'https://api.youcan.shop/oauth/token',
    [
        'form_params' => [
            'grant_type'    => 'refresh_token',
            'client_id'     => '<CLIENT ID>',
            'client_secret' => '<CLIENT SECRET>',
            'refresh_token' => '<REFRESH TOKEN>',
        ],
        'http_errors' => false,
    ]
);
```