Connect OAuth

To connect to YouCan API, you can use the standard OAuth 2 to get an access token.

Prerequisites

Before you begin, ensure you have a Partner Account with YouCan. You can register here.

Setting Up OAuth

Every app owns an OAuth client. The fastest way to create one is the CLI, see get started, then read your credentials with youcan app env show. To create an app from the Partner Dashboard instead:

• Go to the Apps tab in the Partner Dashboard and Click on Create App.
• Select create app manually under Using YouCan Partners > enter an App name> click Create app.

This will automatically generate the OAuth credentials (Client ID and Client Secret) for your app, which you can find in the Apps listing Page.

Note

Ensure that the "Embedded" option is set to False under Configuration in the app's Overview tab after creation

Authorization Request

To obtain an authorization code, redirect the seller to YouCan with the following URL:

https://seller-area.youcan.shop/admin/oauth/authorize?client_id=<CLIENT-ID>&redirect_uri=https://myapp.com/callback&response_type=code&scope[]=read-orders&scope[]=read-products

Request only the scopes your app needs. The seller approves them on the authorization screen. When your app later requests scopes the seller did not grant, the seller goes through the authorization screen again; requests covered by the existing grant skip it.

Warning

The two OAuth endpoints are on different hosts and use different paths:

• Authorization: https://seller-area.youcan.shop/admin/oauth/authorize (include the full /admin/oauth path; /oauth/authorize is not valid)
• Token: https://api.youcan.shop/oauth/token

Exchange Code for Access Token

After the seller accepts the request via the authorization popup, they will be redirected to the specified redirect URI (https://myapp.com/callback). You can then exchange the authorization code for an access token. Here's an example using Laravel:

Route::get(
    '/callback',
    function (Request $request) {
        // If an error occurred or seller rejected authorization
        if ($request->has('error')) {
            if ($request->get('error') === 'access_denied') {
                return 'You canceled the request';
            }

            return "an error occurred";
        }

        $http = new GuzzleHttp\Client;

        $response = $http->post(
            'https://api.youcan.shop/oauth/token',
            [
                'form_params' => [
                    'grant_type'    => 'authorization_code',
                    'client_id'     => '<CLIENT ID>'
                    'client_secret' => '<CLIENT SECRET>',
                    'redirect_uri'  => 'https://myapp.com/callback',
                    'code'          => $request->get('code'),
                ],
                'http_errors' => false,
            ]
        );

        return json_decode((string)$response->getBody(), true);
    }
);

Response:

{
    "token_type": "Bearer",
    "expires_in": 1295999,
    "access_token": "<ACCESS TOKEN>",
    "refresh_token": "<REFRESH TOKEN>"
}

Refresh Token

The expires_in field of the token response holds the access token's lifetime in seconds. Refresh it before it expires using the refresh_token attribute you got from the response. Here's an example of how to refresh it:

$http = new GuzzleHttp\Client;

$response = $http->post(
    'https://api.youcan.shop/oauth/token',
    [
        'form_params' => [
            'grant_type'    => 'refresh_token',
            'client_id'     => '<CLIENT ID>',
            'client_secret' => '<CLIENT SECRET>',
            'refresh_token' => '<REFRESH TOKEN>',
        ],
        'http_errors' => false,
    ]
);