OAuth for public apps: GET request type changed to POST
Last updated
Was this helpful?
Last updated
Was this helpful?
oAuth mechanism for public apps got enhanced security: now the request that exchanges temporary code for the access token requires POST request type with params send as request body.
From now on, the authentication process requires a POST request for the code exchange.
Request must call https://my.ecwid.com/api/oauth/token with a URL-encoded request body. All params in the request body are required and encoded with the Content-Type: application/x-www-form-urlencoded header.
where:
{code} – is the temporary code value received in the previous step (when users click the "Install app" button in Ecwid admin).
{client_id} – is the client_id value for your app.
{client_secret} – is the client_secret value for your app.
{redirect_uri} – is the redirect_url value for your app.
Previously it was possible to get an OAuth token with a GET request type where client_secret and client_id were exposed as query params. This way is now deprecated and no longer works for any apps.
So if you intend to have new installations for your app (for example, if it's a public app or an app available on the reseller partner's channel), you need to update to a new authorization flow.
Check if your app works with Ecwid OAuth for receiving access tokens. For example, if it's a so-called external app with user's dashboard hosted on your side. Such apps always require OAuth to be installed in Ecwid stores.
Update your app code with the new authorization flow: the code must be exchanged through a POST request with URL-encoded body params now.
Breaking changes! Сhanges listed below may break some apps' logic.