OAuth 2.0

For registered apps, Elmatajer supports the standard authorization code flow (with optional PKCE). Ask us for a client_id and client_secret with your redirect URIs and the permissions you need.

#1 · Send the merchant to consent

https://elmatajer.com/oauth/authorize
  ?client_id=app_xxx
  &redirect_uri=https://your-app.com/oauth/callback
  &scope=orders.read webhooks
  &state=RANDOM
  &code_challenge=…&code_challenge_method=S256   (optional, PKCE)

They sign in, review the permissions and approve. We redirect to your redirect_uri with ?code=…&state=….

#2 · Exchange the code (server to server)

curl -X POST https://elmatajer.com/oauth/token \
  -d grant_type=authorization_code \
  -d client_id=app_xxx -d client_secret=YOUR_SECRET \
  -d code=THE_CODE -d redirect_uri=https://your-app.com/oauth/callback

{
  "access_token": "52|kL9…",
  "token_type": "Bearer",
  "scope": "orders.read webhooks",
  "store": { "vendor_id": 5907, "name": "Assem Store" },
  "webhook_secret": "9fK…",
  "api_base": "https://elmatajer.com/api/v1/vendor"
}

Use access_token exactly like an API key. A code is single-use and expires after 5 minutes; any error is 400 invalid_grant.