> For the complete documentation index, see [llms.txt](https://glu.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://glu.gitbook.io/docs/get-started/authentication/oauth.md).

# OAuth

Learn how to authenticate to use the Store API

If you integrate with our OAuth service, you can make API requests on your member's behalf, without your member having to share their credentials with you. This unlocks building a headless members area.

The first step is to configure your OAuth application client which you [manage through your organisation settings here.](https://admin.glu.io/user/select_organisation?route=admin_integrations_oauth_manage) You'll be asked to configure your redirect\_uri and give it a name, the first time you create your application you will be shown you `client_id` and `client_secret` which should be stored securely.

{% stepper %}
{% step %}

### Authorizing as a member

<mark style="color:green;">`GET`</mark> `{store}/oauth/authorize`

Send the user to the authorize URL on the desired store.

| Query parameter | Value                                                                                                              |
| --------------- | ------------------------------------------------------------------------------------------------------------------ |
| `response_type` | Always `code`                                                                                                      |
| `client_id`     | The `client_id` from your application client.                                                                      |
| `redirect_uri`  | One of the pre-configured redirect\_uri from your application client. The user will be redirected here on success. |
| `state`         |                                                                                                                    |

{% endstep %}

{% step %}

### Exchanging the code for a token

<mark style="color:orange;">`POST`</mark> `{store}/token`

On successful authorization, the user will be redirected to the specified `redirect_uri` with a `code` and `state` parameter. You should use this endpoint to exchange the `code` for an access token.

**Body**

| Name            | Type                                                  |
| --------------- | ----------------------------------------------------- |
| `client_id`     | The `client_id` from your application client.         |
| `client_secret` | The `client_secret` from your application client.     |
| `grant_type`    | Always `authorization_code`                           |
| `redirect_uri`  | The redirect\_uri that was used to redirect the user. |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
    "token_type": "Bearer",
    "expires_in": 3600,
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiI4YjU1ZDk3MjJlMDk0ODRlZWM2ZWQ2NzVkODM1MjViMiIsImp0aSI6IjRiMTRlYTJlMDVlN2Q2NmNlNDg4Yzk4NDY0NTEyNjYxOWQzMDU0NTY1MDdiZmJmYzZkMzlhZTdlMDBjNTNmYmIwNDJlZTA2MzdjMTg0YmU4IiwiaWF0IjoxNzUwNzAxMjI0LjI5NzQ5NiwibmJmIjoxNzUwNzAxMjI0LjI5NzUwMiwiZXhwIjoxNzUwNzA0ODI0LjI3MDYzMSwic3ViIjoiZnJlZGRkZGR5eXkrbXltZW1iZXJAZ21haWwuY29tIiwic2NvcGVzIjpbXX0.hnVZ-DIdkKE_VhmyOO5B3q-ISisc1sg2IpCgXhC3X96cxen1gvrFvtQ7GOC1HdTntMzg_DdzJ2WwmmhDyUtSm57UtYtrxbe6NwSv4OiBzC6aR7idKx7XlLu9Hp1gz0XHaDFrH_V2LCZvrf1Ygr6YyNaAavr6rWLq3I3SQ9Em02TCroghf5DWK4bp9jfWygChc7PWmWCni9TTQ5mV-VZrBGTGOalWf2u6_XuY93ua-QJvyKB7Apx1NGFmAtrVXFkUM9PY8XNasCGNEx2VRocUZB_TGjcxdkN1zIavc6ec69uCWj3bMkm5A49mio00slSqH6CGs7r5xevBNovWPNMprA",
    "refresh_token": "def50200181222301b6f0c1c89e6db3a5f254de1d0a5d0324921f900407e5e0371a7375de0ba305393bcad3f3c65b48e361b928b0a71a27f764c20686dfe91f6591d67bde2f6f7199a64847e775f173922651f25c44fff7a7f1a092a412a7f63535559e89e5f37ec77dbf3a16ce82639e61a4ce8b5116e69669ea42724e2f23ca1097726508e5aa401f941a1dfc28821d83ed36dec9ea1d6c8654a8cb129aed0a77634eadf27c9c7c183c6498fb874c370ca967f5d1acba69b2fbb30d2820b092d3666924edb622b3ff95577129f52929bbe84742f1487cc018f07c685c1e5c4ff3a82b8e78e5fd8ace6336acda491f208c1b5b80509902ef6399fe0090813926af2c2fb73731719ff4e4d8a8324409c1154c032b45c45c9756f3e8d65ffe8cc9ea911b69980a8ebfa26e2e2eb8f2645e34405a35d0e7dfaf1f05243c247e4dddf67187ce7b3b16787664a35c0b0e5f5a5201f73fae2fc6b28ee91fafe2166e66204be98a872956fb7a657e60c29bb37d9534353a1f7b7cd28f15521e9494fb2bd212b3ba67487c684f5d40f5d713340a828cca1553e3dcf0ddb07847983c2"
}
```

{% endtab %}

{% tab title="400" %}

```json
{
    "error": "invalid_grant",
    "error_description": "The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.",
    "hint": "Authorization code has expired"
}
```

{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

### Using the access token

Include the access token when making any requests to the [Store API](/docs/api-reference/store-api.md), it is passed as the `Authorization` header with the value `BEARER {access_token}`
{% endstep %}
{% endstepper %}

***

#### Refreshing the access token

<mark style="color:orange;">`POST`</mark> `{store}/token`

You'll want to refresh the access token periodically, to do that you can use the same token endpoint to get a new access token.

**Body**

| Name            | Type                                              |
| --------------- | ------------------------------------------------- |
| `client_id`     | The `client_id` from your application client.     |
| `client_secret` | The `client_secret` from your application client. |
| `grant_type`    | Always `refresh_token`                            |