v2

latestOpenAPI 3.1.02026-07-26102336742.6 KB

Platform Tokens

Exchange authorization code or refresh token for access token

Rate limit: 100 requests / 10 seconds per shop. See Rate limiting.

OAuth 2.0 token endpoint. Supports 'authorization_code' grant type for exchanging authorization codes for tokens, and 'refresh_token' grant type for refreshing access tokens.

post/open-api/v1.0/platform/token

Request body

client_idstring required

OAuth application client ID

client_secretstring

OAuth application client secret (required for confidential clients)

redirect_uristring

Redirect URI used during authorization (required for authorization_code grant)

grant_type'authorization_code' | 'refresh_token' required

OAuth grant type

codestring

Authorization code (required for authorization_code grant)

refresh_tokenstring

Refresh token (required for refresh_token grant)

code_verifierstring

PKCE code verifier (required for public clients using authorization_code grant)

Example request

{
  "client_id": "app_12345",
  "redirect_uri": "https://example.com/callback",
  "grant_type": "authorization_code"
}

Response

object required