Setup and OAuth

Each channel uses its provider's OAuth (or token-exchange) flow. The Upstream module handles the redirect dance and stores the resulting credentials encrypted; Sales Channel reads those credentials when it makes API calls.

Connection flow

1. 1

   Begin the OAuth handshake

   Call the Upstream auth-url endpoint for the vendor. This returns a URL to redirect the user to.

   GET/connect/:vendor/auth-urlJWT

   curl "https://appengine.appmint.io/connect/shopify/auth-url?shop=acme-store.myshopify.com" \
     -H "Authorization: Bearer $JWT" -H "orgid: $ORG"
   

   Response:

   { "authUrl": "https://acme-store.myshopify.com/admin/oauth/authorize?..." }
   

2. 2

   User authorizes

   Redirect the user to authUrl. They sign in to the channel, approve scopes, and the channel redirects back to the Upstream callback.

   GET/connect/:vendor/callbackNo auth

   The callback exchanges the code for an access token and persists the credentials under the vendor connection.

3. 3

   Enable the channel in Sales Channel

   With credentials stored, enable the channel for use. This wires the provider into the Sales Channel registry and validates the connection.

   POST/sales-channel/channels/:channelId/enableJWT

   curl -X POST https://appengine.appmint.io/sales-channel/channels/shopify/enable \
     -H "Authorization: Bearer $JWT" -H "orgid: $ORG" \
     -H "Content-Type: application/json" \
     -d '{
       "shop": "acme-store.myshopify.com",
       "syncInventory": true,
       "syncOrders": true,
       "defaultLocationId": "gid://shopify/Location/12345"
     }'
   

   channelId is one of: amazon, ebay, walmart, etsy, shopify, woocommerce, google, bing, facebook, tiktok, pinterest.

4. 4

   Verify

   GET/sales-channel/channels/:channelId/statusJWT

   curl https://appengine.appmint.io/sales-channel/channels/shopify/status \
     -H "Authorization: Bearer $JWT" -H "orgid: $ORG"
   

   Returns connection health, last sync time, and any auth errors. A red status here means the credentials are missing or expired.

Per-channel auth notes

Disabling and rotating credentials

Disabling removes the channel from the active sync set but keeps stored credentials. Re-enabling does not require re-OAuth unless the token expired.

For credential rotation, re-run the auth-url → callback flow. The new token replaces the old one under the same vendor connection.

Connection storage

Credentials live in the vendor_connection collection under the org. They are AES-encrypted at rest and decrypted in memory only when a provider needs to make a call. Never read or log raw tokens — all logging in the Sales Channel module redacts auth headers.