📘

Note

OAuth 2.0 documentation steps are created for use in the sandbox environment. To build an OAuth flow in the production environments, replace https://sandbox.dev.clover.com/ in the example with the specific regional URL in the request. For example:

• For US & Canada: https://www.clover.com/
• For EU: https://eu.clover.com/

Generate a sandbox OAuth token

To test with the OAuth flow in the sandbox environment, generate a sample access_token on the developer dashboard. If you have not already done so, refer to Creating an app to create an app.

1. On the sandbox Developer Dashboard, select your app from the side navigation pane.
2. Check the pencil icon next to App Type and set it to Web (REST clients).
3. Click Save.
4. Check the pencil icon next to REST Configuration.
5. On the Edit REST Configuration dialog, set Site URL as the landing page of your web app. See Setting app URL & CORS for more information.
6. Set Default OAuth Response as Token (Testing Only).
7. Click Save.

📘

NOTE

For your app to work as expected in production, set the Default OAuth Response as Code and click Save. Use the Clover OAuth 2.0 flow below.

7. Check the pencil icon next to REST Configuration.
8. Click Example OAuth Request.

• If you have multiple test merchant accounts, click to select a test merchant's name.
• If you have not already installed the app for a test merchant, the market listing page for your app appears. Click Connect and then click Accept on the next page.

11. After the browser redirects to your site, copy the access_token value from the address bar.

Define OAuth Concepts

To start, define a few concepts used in the OAuth 2.0 flow:

Client ID

This ID identifies your app on the Clover App Market. This ID confirms that your app is participating in the OAuth 2.0 flow. Your client ID is the App ID value in your app's Settings page on the Developer Dashboard.

Client Secret

This ID is a secret key assigned to your app by Clover. Together, the client ID and client secret authenticate the identity of your app with the Clover server. Your client secret is the App Secret value on your app's Settings page. ImportanT: Do not share this key publicly.

Merchant

A Clover merchant can either be one of two states: unauthorized or authorized. The following table describes these two states:

Authorization Code

An authorized merchant is redirected to your app along with an authorization code. With this code, the Clover server confirms that your request for merchant data has been authorized by the merchant.

https://sandbox.dev.clover.com/oauth/token?client_id={appId}&client_secret={APP_SECRET}&code={AUTHORIZATION_CODE}

API Token

Your app uses the authorization code, client ID, and client secret to negotiate with the Clover server for an API token. With the API token, your app can make REST API calls and access merchant data.

{
   "access_token":"{API_TOKEN}"
}