Password

How to execute the authorization flow and get your access token

The password grant type is used by sales channels to exchange customer credentials for an access token (i.e. to get a "logged" access token).

By including a scope in the access token request, all the resources that you fetch are automatically filtered.

Getting an access token

To get an access token using the password grant type, send a POST request to the /oauth/token endpoint, passing the API client credentials in the request body.

Request

POST https://auth.commercelayer.io/oauth/token

Arguments

Body parameter	Type	Required	Description
grant_type	String	Required	password
username	String	Required	The customer's email address.
password	String	Required	The customer's password.
client_id	String	Required	Your client ID (from your API credentials).
scope	String	Optional	Your access token scope (market, stock location).

Example

Sales channel

Request

The following request tries to get an access token for a sales channel, using the password grant type for a specific user, putting in scope the market identified by the ID "xYZkjABcde":

curl -g -X POST \
  'https://auth.commercelayer.io/oauth/token' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "grant_type": "password",
  "username": "[email protected]",
  "password": "s3creT",
  "client_id": "{{your_client_id}}",
  "scope": "market:id:xYZkjABcde"
}'

Response

On success, the API responds with a 200 OK status code, returning the requested access token and owner info, along with a refresh token:

{
    "access_token": "acC3sSt0K3Nwrt6kic7.abc4bnm5...",
    "token_type": "bearer",
    "expires_in": 14400,
    "refresh_token": "r3fResHt0k3nvbn7mnr9ert123",
    "scope": "market:id:xYZkjABcde",
    "created_at": 123456789,
    "owner_id": "zxcVBnMASd",
    "owner_type": "customer"
}