Installs and tokens
Trade a session token, an install grant or a code for a shop’s tokens.
import { ... } from '@storeware/plugin-sdk';createPkcePair
Generates a PKCE pair.
function createPkcePair(): Promise<PkcePair>createState
An unguessable value to round-trip through the merchant's browser.
function createState(): stringauthorizationUrl
Builds the URL to send a merchant to.
function authorizationUrl(options: AuthorizationUrlOptions): stringexchangeCode
Exchanges an authorization code for tokens.
function exchangeCode(options: TokenRequestOptions & { code: string; redirectUri: string; codeVerifier: string; }): Promise<StorewareTokens>refreshTokens
Rotates a refresh token.
function refreshTokens(options: TokenRequestOptions & { refreshToken: string; }): Promise<StorewareTokens>exchangeSessionToken
Trades the session token your app's home was opened with for the installation's tokens.
function exchangeSessionToken(options: TokenRequestOptions & { sessionToken: string; }): Promise<StorewareTokens>exchangeInstallGrant
Trades the install grant from app.installed.v1 for the installation's tokens. For an app with no home in the admin, which no merchant opens and so is never handed a session. A grant works for an hour.
function exchangeInstallGrant(options: TokenRequestOptions & { grant: string; }): Promise<StorewareTokens>StorewareOAuthError
new StorewareOAuthError(error: string, description: string)PkcePair
| Name | Type | Description |
|---|---|---|
verifier | string | Keep this server side. It is the proof that you started the flow. |
challenge | string | Safe to put in a URL. |
AuthorizationUrlOptions
| Name | Type | Description |
|---|---|---|
clientId | string | |
redirectUri | string | |
scopes | readonly string[] | |
codeChallenge | string | |
state | string | Compare this against what comes back on your callback. |
storeId? | string | Prefills the store picker when you already know which store you want. |
adminUrl? | string | Override for local development. |
StorewareTokens
| Name | Type | Description |
|---|---|---|
accessToken | string | |
refreshToken | string | |
expiresIn | number | |
scopes | string[] | |
storeId | string | |
installationId | string | |
webhookSecret? | string | Returned only when a merchant installs. |
sessionSecret? | string | Also returned only at install. Verifies admin extension sessions. |
DEFAULT_ADMIN_URL
const DEFAULT_ADMIN_URL: 'https://app.storeware.ai'DEFAULT_API_URL
const DEFAULT_API_URL: 'https://api.storeware.ai'TOKEN_EXCHANGE_GRANT
RFC 8693's grant, and the token type of the session the admin hands your home.
const TOKEN_EXCHANGE_GRANT: 'urn:ietf:params:oauth:grant-type:token-exchange'SESSION_TOKEN_TYPE
const SESSION_TOKEN_TYPE: 'urn:storeware:params:oauth:token-type:session-token'INSTALL_GRANT
const INSTALL_GRANT: 'urn:storeware:grant-type:install'