# Installs and tokens

> Trade a session token, an install grant or a code for a shop’s tokens.

Source: https://storeware.ai/docs/sdk/oauth

```ts
import { ... } from '@storeware/plugin-sdk';
```

### createPkcePair

Generates a PKCE pair.

```ts
function createPkcePair(): Promise<PkcePair>
```

### createState

An unguessable value to round-trip through the merchant's browser.

```ts
function createState(): string
```

### authorizationUrl

Builds the URL to send a merchant to.

```ts
function authorizationUrl(options: AuthorizationUrlOptions): string
```

### exchangeCode

Exchanges an authorization code for tokens.

```ts
function exchangeCode(options: TokenRequestOptions & { code: string; redirectUri: string; codeVerifier: string; }): Promise<StorewareTokens>
```

### refreshTokens

Rotates a refresh token.

```ts
function refreshTokens(options: TokenRequestOptions & { refreshToken: string; }): Promise<StorewareTokens>
```

### exchangeSessionToken

Trades the session token your app's home was opened with for the installation's tokens.

```ts
function exchangeSessionToken(options: TokenRequestOptions & { sessionToken: string; }): Promise<StorewareTokens>
```

### exchangeInstallGrant

Trades the install grant from `app.installed.v1` for the installation's tokens. For an app with no home in the admin, which no merchant opens and so is never handed a session. A grant works for an hour.

```ts
function exchangeInstallGrant(options: TokenRequestOptions & { grant: string; }): Promise<StorewareTokens>
```

### StorewareOAuthError

```ts
new StorewareOAuthError(error: string, description: string)
```

### PkcePair

| Name | Type | Description |
| --- | --- | --- |
| `verifier` | `string` | Keep this server side. It is the proof that you started the flow. |
| `challenge` | `string` | Safe to put in a URL. |

### AuthorizationUrlOptions

| Name | Type | Description |
| --- | --- | --- |
| `clientId` | `string` |  |
| `redirectUri` | `string` |  |
| `scopes` | `readonly string[]` |  |
| `codeChallenge` | `string` |  |
| `state` | `string` | Compare this against what comes back on your callback. |
| `storeId?` | `string` | Prefills the store picker when you already know which store you want. |
| `adminUrl?` | `string` | Override for local development. |

### StorewareTokens

| Name | Type | Description |
| --- | --- | --- |
| `accessToken` | `string` |  |
| `refreshToken` | `string` |  |
| `expiresIn` | `number` |  |
| `scopes` | `string[]` |  |
| `storeId` | `string` |  |
| `installationId` | `string` |  |
| `webhookSecret?` | `string` | Returned only when a merchant installs. |
| `sessionSecret?` | `string` | Also returned only at install. Verifies admin extension sessions. |

### DEFAULT_ADMIN_URL

```ts
const DEFAULT_ADMIN_URL: 'https://app.storeware.ai'
```

### DEFAULT_API_URL

```ts
const DEFAULT_API_URL: 'https://api.storeware.ai'
```

### TOKEN_EXCHANGE_GRANT

RFC 8693's grant, and the token type of the session the admin hands your home.

```ts
const TOKEN_EXCHANGE_GRANT: 'urn:ietf:params:oauth:grant-type:token-exchange'
```

### SESSION_TOKEN_TYPE

```ts
const SESSION_TOKEN_TYPE: 'urn:storeware:params:oauth:token-type:session-token'
```

### INSTALL_GRANT

```ts
const INSTALL_GRANT: 'urn:storeware:grant-type:install'
```