Ettajer for Developers
OAuth
Authorization code flow with PKCE S256. One merchant, one store, scoped access — no store ID from the client.
Required. Plain challenges are rejected. Verifier must match at token exchange.
Redirect URI must match a registered value exactly — no wildcards.
Authorization codes expire quickly and cannot be reused.
Flow
- 1
Create an application
In the console, create an app and copy the client ID and secret once. Register exact redirect URIs (Claude and Cursor presets are included).
- 2
Start authorization
Send the merchant to
/oauth/authorizewithclient_id,redirect_uri,response_type=code,scope,state, and PKCEcode_challenge(S256 only). - 3
Merchant consent
The merchant signs in and authorizes scopes for one store. The grant is permanently bound to that store.
- 4
Exchange the code
POST /api/oauth/tokenwithgrant_type=authorization_code, the code, redirect URI, andcode_verifier. Codes are single-use. - 5
Refresh & revoke
Refresh with
grant_type=refresh_token(rotation enabled). Revoke viaPOST /api/oauth/revoke.
Endpoints
Authorize
/oauth/authorize · also /authorize
Browser redirect + consent
Token
/api/oauth/token · also /token
Code exchange & refresh
Revoke
/api/oauth/revoke
Invalidate tokens
Discovery
/.well-known/oauth-authorization-server
AS metadata (PKCE S256)
GET /oauth/authorize ?client_id=… &redirect_uri=… &response_type=code &scope=store:read%20themes:read%20themes:create%20themes:write%20themes:preview &state=… &code_challenge=… &code_challenge_method=S256 POST /api/oauth/token grant_type=authorization_code code=… redirect_uri=… client_id=… client_secret=… code_verifier=…
Common redirect URIs
Must be registered exactly on the app.
Claude
https://claude.ai/api/mcp/auth_callbackCursor (local)
http://localhost:8787/callbackCursor (cloud)
https://www.cursor.com/agents/mcp/oauth/callback
Create an OAuth app
Register redirect URIs, then connect Claude or Cursor.