Oauth Authentication

Introduction 

In order to access services which require authentication, an OAuth2 token has to be passed as a parameter to such a service. The token is obtained during the authentication process which is described below. Two parties are involved in this process:

• client – a company or individual who integrates their software with Ship2Anywhere,

• user – a particular Ship2Anywhere user on behalf who authentication is performed.

1. Login page display

First step of authentication is a request from user's web browser. URL the browser visits contains the client_idGET parameter. The login page is displayed at this step.

Example

Note: “www” has to be present in this URL, otherwise it may fail to work properly.

2. User logs in and grants permission

At this stage the user logs in and they are asked for authorization to access their account data.

3. Redirect to given location

After granting permission to a client's application, the user's browser is redirected to a location given during the OAuth2 keys generation by the client. The redirect location URL contains a code parameter which the client's application should exchange for a token in the next stage.

Example

4. Exchange code for token

In the final stage the client's application exchanges a code for the access token. In order to do this, it sends a POST request which contains the client_id, client_secret and previously obtained code.

Example

Response is a JSON data containing token plus some additional information:

After successfully obtaining an OAuth2 token, the client's application can call the Ship2Anywhere services on behalf a user who has just been authorized.

Important:

A client's application should always obtain a separate token for each user.