Get OAuth token

curl --request POST \
  --url https://{environment}.boltapp.com/v3/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=8fd9diIy59sj.IraJdeIgmdsO.fd233434fg2c616cgo932aa6e1e4fc627a9385045gr395222a127gi93c595rg4 \
  --data client_secret=23ee7ec7301779eaff451d7c6f6cba322499e3c0ec752f800c72a8f99217e3a8 \
  --data-urlencode scope%5B0%5D=bolt.account.manage \
  --data-urlencode scope%5B1%5D=bolt.account.view \
  --data-urlencode scope%5B2%5D=openid \
  --data state=xyzABC123 \
  --data grant_type=authorization_code \
  --data code=7GSjMRSHs6Ak7C_zvVW6P2IhZOHxMK7HZKW1fMX85ms

{
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImFsaWNlQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6MTcwNTY1MTczMSwiZmlyc3RfbmFtZSI6IkFsaWNlIiwiaXNzIjoiaHR0cDovL2FwaS5ib2x0LmNvbSIsImxhc3RfbmFtZSI6IkJha2VyIiwicGhvbmVfbnVtYmVyIjoiKzE0MTU1NTUwMTk5IiwicGhvbmVfbnVtYmVyX3ZlcmlmaWVkIjp0cnVlLCJpYXQiOjE3MDU2NDg0MjF9.Ir0aKx40zfNCZol1DnqchFx9ciHlyZY9y10mndEjOBHhpHif8-7aZl2UoJVs_0Hj-5ArEouUD6n-y1SJD0Wns-gDMoA0Etoc5dT_0zt0Kw5T8FvJWbyKyyGSDEwPFVADIRxDPMpVoHx0C0nwr_GudnIX7YG6p2HCsoGm2C04ZxKpifSixB3-xNB6k9u1ESWh0KjMCYzBQ2x9wbQ_S6kFtio075PFYcZ3iRQz8oD15NsZDd2czzZkRnGTGlpG0sAvScLXMvDDOWBIu-4wvOEOT7avunJQ_rOCYUlyJe7JGh0QllpeJNau8kx-4YGMeFTkeGM_hPIKsRF1e6o_rWp5CMJnmJDPme-zlJxWodyaHNed5XW-4DR7blv_PFOJNrRvymRoTOd74LIpS21GRCNYrphj7N6-TsSfO9hMQ9ehxrgNAryWbVtTM_3VvWyzX-SRa7BcRkS97sokxc04s3cbXra3x6brE3uL1yoOWNf8GDZNkv1uUAnrOZcTuLacrPjkQgOPb-chMiWS1L0Zd1wX3rqpeCyEswsGKxRRkpgwoBaVVQmLB9m51B6SXEvURTcy2Hx8KzgfXQ_-uC-KrniQxWzYms8A1lypKXkEcyMD2E4Q7EB4UeD2qZAk4tZo611uHegaHaEM7EQyFN3nxvibaqFpXzdxVmOCX0_wQr1nDNA",
  "access_token": "KCqordmSK6_lpkaXaXfGD8LwnKMGGOYy4Ju2IaBXpJI.CzOF7QOmGGQEgIzBjxOEh1FbRdDpzf9zbm9eHrCZ6zw",
  "expires_in": 3600,
  "refresh_token": "4hJYNO4GHvALZoocXoLenfNeFy1RR5ZT6G5JYrFbvkI.Q_PqV0lIszCNoN-85EwD-2nYZOVEepVgJSolx-Jbzrs",
  "refresh_token_scope": "bolt.account.view",
  "scope": "bolt.account.manage openid",
  "token_type": "bearer"
}

{
  ".tag": "unprocessable_request",
  "message": "We were unable to process your request."
}

POST

oauth

token

curl --request POST \
  --url https://{environment}.boltapp.com/v3/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=8fd9diIy59sj.IraJdeIgmdsO.fd233434fg2c616cgo932aa6e1e4fc627a9385045gr395222a127gi93c595rg4 \
  --data client_secret=23ee7ec7301779eaff451d7c6f6cba322499e3c0ec752f800c72a8f99217e3a8 \
  --data-urlencode scope%5B0%5D=bolt.account.manage \
  --data-urlencode scope%5B1%5D=bolt.account.view \
  --data-urlencode scope%5B2%5D=openid \
  --data state=xyzABC123 \
  --data grant_type=authorization_code \
  --data code=7GSjMRSHs6Ak7C_zvVW6P2IhZOHxMK7HZKW1fMX85ms

{
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImFsaWNlQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6MTcwNTY1MTczMSwiZmlyc3RfbmFtZSI6IkFsaWNlIiwiaXNzIjoiaHR0cDovL2FwaS5ib2x0LmNvbSIsImxhc3RfbmFtZSI6IkJha2VyIiwicGhvbmVfbnVtYmVyIjoiKzE0MTU1NTUwMTk5IiwicGhvbmVfbnVtYmVyX3ZlcmlmaWVkIjp0cnVlLCJpYXQiOjE3MDU2NDg0MjF9.Ir0aKx40zfNCZol1DnqchFx9ciHlyZY9y10mndEjOBHhpHif8-7aZl2UoJVs_0Hj-5ArEouUD6n-y1SJD0Wns-gDMoA0Etoc5dT_0zt0Kw5T8FvJWbyKyyGSDEwPFVADIRxDPMpVoHx0C0nwr_GudnIX7YG6p2HCsoGm2C04ZxKpifSixB3-xNB6k9u1ESWh0KjMCYzBQ2x9wbQ_S6kFtio075PFYcZ3iRQz8oD15NsZDd2czzZkRnGTGlpG0sAvScLXMvDDOWBIu-4wvOEOT7avunJQ_rOCYUlyJe7JGh0QllpeJNau8kx-4YGMeFTkeGM_hPIKsRF1e6o_rWp5CMJnmJDPme-zlJxWodyaHNed5XW-4DR7blv_PFOJNrRvymRoTOd74LIpS21GRCNYrphj7N6-TsSfO9hMQ9ehxrgNAryWbVtTM_3VvWyzX-SRa7BcRkS97sokxc04s3cbXra3x6brE3uL1yoOWNf8GDZNkv1uUAnrOZcTuLacrPjkQgOPb-chMiWS1L0Zd1wX3rqpeCyEswsGKxRRkpgwoBaVVQmLB9m51B6SXEvURTcy2Hx8KzgfXQ_-uC-KrniQxWzYms8A1lypKXkEcyMD2E4Q7EB4UeD2qZAk4tZo611uHegaHaEM7EQyFN3nxvibaqFpXzdxVmOCX0_wQr1nDNA",
  "access_token": "KCqordmSK6_lpkaXaXfGD8LwnKMGGOYy4Ju2IaBXpJI.CzOF7QOmGGQEgIzBjxOEh1FbRdDpzf9zbm9eHrCZ6zw",
  "expires_in": 3600,
  "refresh_token": "4hJYNO4GHvALZoocXoLenfNeFy1RR5ZT6G5JYrFbvkI.Q_PqV0lIszCNoN-85EwD-2nYZOVEepVgJSolx-Jbzrs",
  "refresh_token_scope": "bolt.account.view",
  "scope": "bolt.account.manage openid",
  "token_type": "bearer"
}

{
  ".tag": "unprocessable_request",
  "message": "We were unable to process your request."
}

Body

application/x-www-form-urlencoded

Option 1
Option 2

Perform the initial token exchange, using the authorization code provided by Bolt's Login Modal.

client_id

string

required

The OAuth client ID, which corresponds to the merchant publishable key, which can be retrieved in your Merchant Dashboard.

Example:

"8fd9diIy59sj.IraJdeIgmdsO.fd233434fg2c616cgo932aa6e1e4fc627a9385045gr395222a127gi93c595rg4"

client_secret

string

required

The OAuth client secret, which corresponds the merchant API key, which can be retrieved in your Merchant Dashboard.

Example:

"23ee7ec7301779eaff451d7c6f6cba322499e3c0ec752f800c72a8f99217e3a8"

scope

enum<string>[]

required

The requested scopes. If the request is successful, the OAuth client will be able to perform operations requiring these scopes.

Available options:

bolt.account.manage,

bolt.account.view,

openid

grant_type

enum<string>

required

The type of OAuth 2.0 grant being utilized.

Available options:

authorization_code

Example:

"authorization_code"

code

string

required

Fetched value using OTP value from the Authorization Modal.

Example:

"7GSjMRSHs6Ak7C_zvVW6P2IhZOHxMK7HZKW1fMX85ms"

state

string

A randomly generated string sent along with an authorization code. This must be included if provided. It is used to prevent cross-site request forgery (CSRF) attacks.

Example:

"xyzABC123"

Response

Access token is successfully fetched

id_token

string

A JSON Web Token (JWT) issued when the request includes the scope open_id.

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImFsaWNlQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6MTcwNTY1MTczMSwiZmlyc3RfbmFtZSI6IkFsaWNlIiwiaXNzIjoiaHR0cDovL2FwaS5ib2x0LmNvbSIsImxhc3RfbmFtZSI6IkJha2VyIiwicGhvbmVfbnVtYmVyIjoiKzE0MTU1NTUwMTk5IiwicGhvbmVfbnVtYmVyX3ZlcmlmaWVkIjp0cnVlLCJpYXQiOjE3MDU2NDg0MjF9.Ir0aKx40zfNCZol1DnqchFx9ciHlyZY9y10mndEjOBHhpHif8-7aZl2UoJVs_0Hj-5ArEouUD6n-y1SJD0Wns-gDMoA0Etoc5dT_0zt0Kw5T8FvJWbyKyyGSDEwPFVADIRxDPMpVoHx0C0nwr_GudnIX7YG6p2HCsoGm2C04ZxKpifSixB3-xNB6k9u1ESWh0KjMCYzBQ2x9wbQ_S6kFtio075PFYcZ3iRQz8oD15NsZDd2czzZkRnGTGlpG0sAvScLXMvDDOWBIu-4wvOEOT7avunJQ_rOCYUlyJe7JGh0QllpeJNau8kx-4YGMeFTkeGM_hPIKsRF1e6o_rWp5CMJnmJDPme-zlJxWodyaHNed5XW-4DR7blv_PFOJNrRvymRoTOd74LIpS21GRCNYrphj7N6-TsSfO9hMQ9ehxrgNAryWbVtTM_3VvWyzX-SRa7BcRkS97sokxc04s3cbXra3x6brE3uL1yoOWNf8GDZNkv1uUAnrOZcTuLacrPjkQgOPb-chMiWS1L0Zd1wX3rqpeCyEswsGKxRRkpgwoBaVVQmLB9m51B6SXEvURTcy2Hx8KzgfXQ_-uC-KrniQxWzYms8A1lypKXkEcyMD2E4Q7EB4UeD2qZAk4tZo611uHegaHaEM7EQyFN3nxvibaqFpXzdxVmOCX0_wQr1nDNA"

access_token

string

An access token you can use to make requests on behalf of a Bolt shopper.

Example:

"KCqordmSK6_lpkaXaXfGD8LwnKMGGOYy4Ju2IaBXpJI.CzOF7QOmGGQEgIzBjxOEh1FbRdDpzf9zbm9eHrCZ6zw"

expires_in

integer

The access token's expiration, in seconds.

Example:

3600

refresh_token

string

A refresh token you can use to issue a brand new access token without obtaining a new authorization code.

Example:

"4hJYNO4GHvALZoocXoLenfNeFy1RR5ZT6G5JYrFbvkI.Q_PqV0lIszCNoN-85EwD-2nYZOVEepVgJSolx-Jbzrs"

refresh_token_scope

string

The scope granted to the refresh token. Currently, refreshed token will only grant view permissions.

Example:

"bolt.account.view"

scope

string

The scope granted to access token, depending on the scope granted to the authorization code as well as the scope parameter. Options include bolt.account.manage, bolt.account.view, openid. Multiple values can be returned as space-separated strings.

Example:

"bolt.account.manage openid"

token_type

string

The token_type will always be bearer.

Example:

"bearer"

Introduction

Merchant Callback

Merchant Callback reference

Endpoints

Embeddable Checkout v3

Embeddable Checkout v1

Tokenizer

Body

Response