{"description":"Test vectors for checking your own code against how Storeware signs requests and session tokens. Every secret here is a test value that signs nothing real.","page":"https://storeware.ai/docs/webhooks/other-languages","version":1,"notes":["A secret is used as the bytes of its text, as UTF-8. It looks like hex, but do not decode it.","Check your code at the time each vector names as now, not the clock on your machine.","made_with says how a header or token was made, so you can see why it is refused. Your code never reads it."],"signed_requests":{"description":"The storeware-signature header on every request Storeware makes to your app. v2 is hex HMAC-SHA256 over t, a dot, the kind, a dot and the raw body. v1 signs no kind, so never accept it alone. endpoint_kind is the kind your endpoint serves, which may differ from what the storeware-kind header says.","tolerance_seconds":300,"vectors":[{"name":"webhook-accepted","description":"A webhook, checked at a webhook endpoint twelve seconds after it was signed.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1790000012,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec,v2=e04cb5abcd401a375399e86a95a5069f2323ee347ed8c0649b4ee1979169a0f4","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"accept","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"webhook-at-a-tool-endpoint","description":"The same webhook, sent to an endpoint that serves tool calls. v2 was signed as a webhook, so it does not match.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"tool","now":1790000012,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec,v2=e04cb5abcd401a375399e86a95a5069f2323ee347ed8c0649b4ee1979169a0f4","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"refuse","reason":"signature mismatch","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"block-accepted","description":"A storefront block request, checked at a block endpoint.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"block","now":1790000003,"headers":{"storeware-signature":"t=1790000000,v1=fde06c2f7d0f801a3caa8576c04e06962147bd7a3821c2d121d08d722d14fdf0,v2=365ce38973d53a8a27dd77fc71ce13931d93a29a5d98581c08382faab74bcf5a","storeware-kind":"block"},"body":"{\"block\":\"reviews\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"context\":{\"productHandle\":\"linen-apron\"}}","expect":"accept","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"block","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"webhook-at-the-edge-of-the-window","description":"Checked exactly 300 seconds after it was signed, which is still inside the window.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1790000300,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec,v2=e04cb5abcd401a375399e86a95a5069f2323ee347ed8c0649b4ee1979169a0f4","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"accept","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"webhook-too-old","description":"Checked 301 seconds after it was signed. The signature is correct, but a request this old could be a replay.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1790000301,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec,v2=e04cb5abcd401a375399e86a95a5069f2323ee347ed8c0649b4ee1979169a0f4","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"refuse","reason":"timestamp outside the tolerance window","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"webhook-from-the-future","description":"Signed 301 seconds later than now. The window runs both ways.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1789999699,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec,v2=e04cb5abcd401a375399e86a95a5069f2323ee347ed8c0649b4ee1979169a0f4","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"refuse","reason":"timestamp outside the tolerance window","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"webhook-wrong-secret","description":"Signed with a secret that is not yours.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1790000012,"headers":{"storeware-signature":"t=1790000000,v1=805697fb229967bbfd74333158691f9913f63eaf1b081ea14e9bdfe351889995,v2=fefa5e4d5ab92df0fec47d63d81b5b9451c1a4da962a28b8c5d0b4566ec694cb","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"refuse","reason":"signature mismatch","made_with":{"secret":"fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"]}},{"name":"webhook-v1-only","description":"A header with a correct v1 and no v2. v1 signs no kind, so it is never enough on its own.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1790000012,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec","storeware-kind":"webhook"},"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}","expect":"refuse","reason":"malformed signature header","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1"]}},{"name":"webhook-body-parsed-and-encoded-again","description":"The body after it was parsed and turned back into text with spaces. The bytes differ from the ones that were signed, so check the raw body before you parse it.","secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","endpoint_kind":"webhook","now":1790000012,"headers":{"storeware-signature":"t=1790000000,v1=5bc29305749c4482ae2e72a35aa906292493116b94aafbed4dff4843853031ec,v2=e04cb5abcd401a375399e86a95a5069f2323ee347ed8c0649b4ee1979169a0f4","storeware-kind":"webhook"},"body":"{\"id\": \"evt_test_1\", \"event\": \"order.paid.v1\", \"storeId\": \"00000000-0000-4000-8000-000000000002\", \"createdAt\": \"2026-09-21T14:13:20.000Z\", \"data\": {\"orderId\": \"00000000-0000-4000-8000-000000000003\", \"note\": \"Crème brûlée, gift wrapped\"}}","expect":"refuse","reason":"signature mismatch","made_with":{"secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","kind":"webhook","timestamp":1790000000,"parts":["t","v1","v2"],"body":"{\"id\":\"evt_test_1\",\"event\":\"order.paid.v1\",\"storeId\":\"00000000-0000-4000-8000-000000000002\",\"createdAt\":\"2026-09-21T14:13:20.000Z\",\"data\":{\"orderId\":\"00000000-0000-4000-8000-000000000003\",\"note\":\"Crème brûlée, gift wrapped\"}}"}}]},"session_tokens":{"description":"The session token the admin opens your app's home or panel with, in its session query parameter. Three base64url parts joined by dots: the header, the claims, and the base64url HMAC-SHA256 of the first two parts and the dot between them, keyed with your session_secret. Accept only alg HS256, aud equal to your client id, exp later than now, and iat no more than 60 seconds ahead of now.","vectors":[{"name":"session-accepted","description":"A session for your app, checked thirty seconds after it was made.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1790000030,"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.2vcOvfLi7LjEjUIsbtkSTmr1vVClrZ7v6o3HvRX4HoE","header":{"alg":"HS256","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"vectors-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"accept","made_with":{"secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"}},{"name":"session-for-another-app","description":"Correctly signed, but its aud names another app's client id.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1790000030,"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6ImFub3RoZXItdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.tAtReHfr_buOvLkhgyZlc02s0brdqKfvLIpn54g3ydc","header":{"alg":"HS256","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"another-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"refuse","reason":"token is for another app","made_with":{"secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"}},{"name":"session-expired","description":"Checked at the second its exp names. A token is expired from that second on.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1790000300,"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.2vcOvfLi7LjEjUIsbtkSTmr1vVClrZ7v6o3HvRX4HoE","header":{"alg":"HS256","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"vectors-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"refuse","reason":"token has expired","made_with":{"secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"}},{"name":"session-issued-in-the-future","description":"Its iat is 61 seconds ahead of now, more than a clock could drift.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1789999939,"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.2vcOvfLi7LjEjUIsbtkSTmr1vVClrZ7v6o3HvRX4HoE","header":{"alg":"HS256","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"vectors-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"refuse","reason":"token was issued in the future","made_with":{"secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"}},{"name":"session-wrong-secret","description":"Signed with a secret that is not yours.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1790000030,"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.K0RTi8N3q2UoOE6xixppqzBNQQMjvOiXuP9BZEzW4Zk","header":{"alg":"HS256","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"vectors-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"refuse","reason":"signature mismatch","made_with":{"secret":"fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210"}},{"name":"session-alg-none-unsigned","description":"The header says alg none and the signature is empty. Read the algorithm from your own code, never from the token.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1790000030,"token":"eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.","header":{"alg":"none","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"vectors-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"refuse","reason":"unsupported signature algorithm","made_with":{"secret":null}},{"name":"session-alg-none-signed","description":"The header says alg none, yet the signature is a correct HMAC with your secret. Only a check of the header refuses it.","secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","client_id":"vectors-test-app","now":1790000030,"token":"eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.PTfZvf5KLxEVWyPSfvLbC1U1EjI7f7FUzBvpFoeVryU","header":{"alg":"none","typ":"JWT"},"claims":{"iss":"https://storeware.ai","aud":"vectors-test-app","sub":"00000000-0000-4000-8000-000000000005","iat":1790000000,"exp":1790000300,"jti":"00000000-0000-4000-8000-000000000006","sid":"00000000-0000-4000-8000-000000000001","store_id":"00000000-0000-4000-8000-000000000002","org_id":"00000000-0000-4000-8000-000000000007","context":{"productId":"00000000-0000-4000-8000-000000000004"}},"expect":"refuse","reason":"unsupported signature algorithm","made_with":{"secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"}}]},"token_exchange":{"description":"How your server trades a session token, or the install grant from app.installed.v1, for the installation's tokens. Send it from your server, never from a browser: the request carries your client secret.","url":"https://api.storeware.ai/api/oauth/token","method":"POST","headers":{"content-type":"application/x-www-form-urlencoded"},"session_token":{"description":"RFC 8693 token exchange. subject_token is the session-accepted token above.","fields":{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","subject_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.2vcOvfLi7LjEjUIsbtkSTmr1vVClrZ7v6o3HvRX4HoE","subject_token_type":"urn:storeware:params:oauth:token-type:session-token","client_id":"vectors-test-app","client_secret":"swcs_test_client_secret_not_real"},"body":"grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&subject_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3N0b3Jld2FyZS5haSIsImF1ZCI6InZlY3RvcnMtdGVzdC1hcHAiLCJzdWIiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDUiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMDMwMCwianRpIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDA2Iiwic2lkIjoiMDAwMDAwMDAtMDAwMC00MDAwLTgwMDAtMDAwMDAwMDAwMDAxIiwic3RvcmVfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDIiLCJvcmdfaWQiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDciLCJjb250ZXh0Ijp7InByb2R1Y3RJZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwNCJ9fQ.2vcOvfLi7LjEjUIsbtkSTmr1vVClrZ7v6o3HvRX4HoE&subject_token_type=urn%3Astoreware%3Aparams%3Aoauth%3Atoken-type%3Asession-token&client_id=vectors-test-app&client_secret=swcs_test_client_secret_not_real"},"install_grant":{"description":"For an app with no home in the admin. grant comes from the app.installed.v1 event and works for an hour. Your app passes it on as it is; it cannot check it.","fields":{"grant_type":"urn:storeware:grant-type:install","grant":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJpbnN0YWxsIiwiYXVkIjoidmVjdG9ycy10ZXN0LWFwcCIsInNpZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwMSIsImlhdCI6MTc5MDAwMDAwMCwiZXhwIjoxNzkwMDAzNjAwLCJqdGkiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDgifQ.OmoJOwpwAhYEALTj1tKqnPMneVzJGRkmJeTv1eCcoJw","client_id":"vectors-test-app","client_secret":"swcs_test_client_secret_not_real"},"grant_claims":{"typ":"install","aud":"vectors-test-app","sid":"00000000-0000-4000-8000-000000000001","iat":1790000000,"exp":1790003600,"jti":"00000000-0000-4000-8000-000000000008"},"body":"grant_type=urn%3Astoreware%3Agrant-type%3Ainstall&grant=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJpbnN0YWxsIiwiYXVkIjoidmVjdG9ycy10ZXN0LWFwcCIsInNpZCI6IjAwMDAwMDAwLTAwMDAtNDAwMC04MDAwLTAwMDAwMDAwMDAwMSIsImlhdCI6MTc5MDAwMDAwMCwiZXhwIjoxNzkwMDAzNjAwLCJqdGkiOiIwMDAwMDAwMC0wMDAwLTQwMDAtODAwMC0wMDAwMDAwMDAwMDgifQ.OmoJOwpwAhYEALTj1tKqnPMneVzJGRkmJeTv1eCcoJw&client_id=vectors-test-app&client_secret=swcs_test_client_secret_not_real"},"response":{"description":"What both requests answer with, status 200. webhook_secret and session_secret are the secrets the vectors above use. Store both: no other endpoint hands them back.","status":200,"body":{"access_token":"swt_test_access_token_not_real","refresh_token":"swr_test_refresh_token_not_real","token_type":"Bearer","expires_in":86400,"scope":"orders:read products:read","store_id":"00000000-0000-4000-8000-000000000002","installation_id":"00000000-0000-4000-8000-000000000001","issued_token_type":"urn:ietf:params:oauth:token-type:access_token","webhook_secret":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","session_secret":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"}},"error_response":{"description":"A refusal, in the RFC 6749 shape. Every way an exchange can fail answers invalid_grant with the same words, so the answer says nothing about which part was wrong.","status":400,"body":{"error":"invalid_grant","error_description":"That authorization code is not valid"}}}}