v3 authentication- any simpler way? #818

valentina-inumi · 2023-01-12T21:02:33Z

valentina-inumi
Jan 12, 2023

Hi!
I'm writing an electron app to manage my store.
I believe the auth flow is made so that app devs can request the token, and it takes a long time for the user (shop owner) to approve the API request- hence the redirect url to notify when that's done.

My use case is- my electron desktop app, only my shop. Is there some way that I can get access to my own shop data without having to go through the entire token acquire procedure?
Or some simpler way to acquire token, like- here's my key and secret, gimme the bearer token in 1 fetch (like FedEx API does for example)

Answered by Makebuildmodify

Jan 13, 2023

@valentina-inumi

Do you need help with the token acquisition process?

I believe my API v3 use case is the same as yours; being that you are both the "User" and the "developer" with nobody else using your "App".

I have my procedural notes for simplified (kind of) token acquisition. Let me know is you would like me to post them.

View full answer

Gareth064 · 2023-01-12T21:20:03Z

Gareth064
Jan 12, 2023

There is no such thing as Key and secret in the v3 app. You have to do the token dance am afraid.

2 replies

valentina-inumi Jan 13, 2023
Author

There is some shared secret that you get, apart from the API key. But it's quite short and IDK what is it used for.

Makebuildmodify Jan 13, 2023

I think it's a vestigial token for use with Oauth 1.0 to let you have backward compatibility. It would be needed if you were using the new credentials to work on an older API v2 App with OAuth 1.0. As far as I know (at least for what I've done so far) It's not needed for the OAuth 2.0 process.

Corrections are welcome if I'm wrong about that.

Makebuildmodify · 2023-01-13T01:11:34Z

Makebuildmodify
Jan 13, 2023

@valentina-inumi

Do you need help with the token acquisition process?

I believe my API v3 use case is the same as yours; being that you are both the "User" and the "developer" with nobody else using your "App".

I have my procedural notes for simplified (kind of) token acquisition. Let me know is you would like me to post them.

2 replies

valentina-inumi Jan 13, 2023
Author

Yes, pretty please with sugar on top!

Makebuildmodify Jan 13, 2023

READ ME

Steps to get Etsy API v3 access Tokens

These are my notes to myself for getting Oauth 2.0 tokens from the Etsy 0Auth 2.0 authorization server.
Once you have the tokens you will be able to use the Etsy API v3 at whatever permission scope you requested.

The context for these notes is for an Etsy Shop Owner that is writing a program for their own use only. For example: A program that automatically lists items from a set of descriptions and images. In this use case the "App developer" and the "User/Shop Owner/App user" are the same person/company.

I am sharing these as a, "What I did", with hope that it will shed some light on the token acquisition process and maybe reduce the amount of time others will spend learning the topic.

It's not a, "what you should do." You need to make that decision for yourself.

Good Luck!

Phase 0 - Set up

# If you haven't already:
  # Request an Etsy App API "keystring" (client_id) and "shared secret" (client_secret).

# Create a callback URI at a domain with which you have control.
  # The callback URI's domain must match the domain that is associated with the app.
    # Example of registered domain:   https://www.yourdomainhere.com
    # Example of registered callback: https://www.yourdomainhere.com/callback
      # You can, if needed, changed both of the domain and callback here:
          # https://www.etsy.com/developers/your-apps

  # Your callback landing page needs to have an index.html (or the like) landing page.
    # The content is simple and can be a single <h1> tag.

    # EXAMPLE:

      <!DOCTYPE html>
      <html lang="en">
      <head>
          <meta charset="UTF-8">
          <meta http-equiv="X-UA-Compatible" content="IE=edge">
          <meta name="viewport" content="width=device-width, initial-scale=1.0">
          <title>Document</title>
      </head>
      <body>
          <h1>Awesome, thanks!</h1>
      </body>
      </html>

Phase 1 - Getting consent from the "User"

## ACTING AS THE DEVELOPER

# Get the code-generator.js (node.js) script Here:
  # https://developers.etsy.com/documentation/tutorials/quickstart#generate-the-pkce-code-challenge

  # OR use the one I modified to work for/with these notes,
    # To run the code-generator.js (node.js) script.  
      # Make sure to set your:
        # client_id (also called "keystring")
        # redirect URI (also called "callback url")
        # scope permissions settings, SEE REFERENCE HERE: https://developers.etsy.com/documentation/essentials/authentication#scopes
        # To input your perameters look for the "// ###### YOUR STUFF BELOW ######" comment

   # NOTE: If needed you can get and install node.js here: https://nodejs.dev/en/

// START NODE.JS 
const crypto = require("crypto");

// The next two functions help us generate the code challenge.
// Required by Etsy’s OAuth implementation.
const base64URLEncode = (str) =>
    str
        .toString("base64")
        .replace(/\+/g, "-")
        .replace(/\//g, "_")
        .replace(/=/g, "");

const sha256 = (buffer) => crypto.createHash("sha256").update(buffer).digest();

// We’ll use the verifier to generate the challenge.
// The verifier needs to be saved for a future step in the OAuth flow.
const codeVerifier = base64URLEncode(crypto.randomBytes(32));

// With these functions, we can generate
// The values needed for our OAuth authorization grant.
const codeChallenge = base64URLEncode(sha256(codeVerifier));
const state = Math.random().toString(36).substring(7);



// ###### YOUR STUFF BELOW ######
// Bulk Lister 2.0 keystring
const client_id = 'your client_id here';

// Redirect URI for my app 
const redirect_uri = "https://yourdomainhere.com/callback/";

// Scope string
const scope = "Your desireed authorization scope here";

// EXAMPLE: const scope = "listings_d%20listings_w%20listings_r%20";
// SCOPES REF IS HERE: https://developers.etsy.com/documentation/essentials/authentication#scopes

// ###### YOUR STUFF ABOVE ######



console.log(`State: ${state}`);
console.log(`Code challenge: ${codeChallenge}`);
console.log(`Code verifier: ${codeVerifier}`);
console.log(`Full URL: https://www.etsy.com/oauth/connect?response_type=code&redirect_uri=${redirect_uri}&scope=${scope}&client_id=${client_id}&state=${state}&code_challenge=${codeChallenge}&code_challenge_method=S256`);

// END NODE.JS

# The script will print out to the command line something that looks like this (below).
  #Copy and save it for later use.

State: arandomstring
Code challenge: lNlLLaRIkANdNPQxxxxxxxxxxxxxxxxxxxxxxxxxxx
Code verifier: GmmYgxiVRpMYplo3xxxxxxxxxxxxxxxxxxxxxxxxxxx
Full URL: https://www.etsy.com/oauth/connect?response_type=code&redirect_uri=https://yourdomainhere.com/callback/&scope=listings_d%20listings_w%20listings_r%20&client_id=<your_client_id_here>&state=3zve1&code_challenge=lNlLLaRIkANdNPQxxxxxxxxxxxxxxxxxxxxxxxxxxx&code_challenge_method=S256

Phase 1.5 - Request for access grant from User

## ACTING AS THE "USER"

# Next: Find the "Full URL" KEY:VALUE pair (above at the end of Phase 1).
  # Copy the value for "Full URL" and paste it into a browser window.

# This is the first request to the Oauth server in the Oauth flow.
  # (NOTE: "flow" is an Oauth term. There are a few different "flows". We are using the "grant authorization" flow).
  # A quick refresher for this flow on this video here: https://youtube.com/watch?v=sSy5-3IkXHE 

# This is also the step that would be the "App" sending the "User" to the Oauth server to get permission from the "User".

# The "User" (in this case you) will be sent to an Etsy "grant access" webpage where the "User" (in this case you) clicks the "grant access" button.

# If the Oauth server is nice it will redirect the "User" (in this case you) to the App builder's redirect URI landing page (in this case your callback url).

# Once the "User" (in this case you) is on the landing page the necessary parameters will be available in the address bar.
  # A successful return value looks something like this:

  https://yourdomainhere.com/callback/callback/?code=xxxxxxxxxxxxxxxxxxxxu5Q24USxm_kfKVjprXeYCROUaGWxulhmJTjxxxxxxxxxxxxxxxxxxxxx&state=arandomstring

Phase 2 - request OAuth tokens

# ACTING AS THE DEVELOPER

# This is now the second request to OAuth server.

# Make a POST request with cURL 
  # You will need to create a JSON object to pass to cURL
  # It needs to have your
    # "client_id"     - AKA your "keystring" from the Etsy app approval.
    # "redirect_uri"  - This value must match the registered URI (AKA callback URL) character for character.
    # "code_verifier" - This is the "Code verifier" value returned to the developer at the end of "Phase 1"
    # "code"          - This is the "code" value returned to the "User" (in this case was you) at the end of "Phase 1.5"
    # "grant_type"    - is literally "grant_type":"authorization_code",

    # NOTE: THE GRANT TYPE LINE IS LEFT JUST AS IT IS = "grant_type":"authorization_code",
    # YOU ADD THE OTHER 4 FOLLOWING VALUES

    # EXAMPLE JSON:
    {
      "grant_type":"authorization_code", 
      "client_id":"put_your_client_id_here",
      "redirect_uri":"https://yourdomainhere.com/callback/",
      "code":"xxxxxxxxxxxxxxxxxxxxu5Q24USxm_kfKVjprXeYCROUaGWxulhmJTjxxxxxxxxxxxxxxxxxxxxx",
      "code_verifier":"GmmYgxiVRpMYplo3xxxxxxxxxxxxxxxxxxxxxxxxxxx"
    }

    # Take out all of the newlines in the JSON object and add it to a single line cURL POST request
      # Then copy and paste on the command line

      curl -d '{"grant_type":"authorization_code","client_id":"put_your_client_id_here","redirect_uri":"https://yourdomainhere.com/callback/","code":"xxxxxxxxxxxxxxxxxxxxu5Q24USxm_kfKVjprXeYCROUaGWxulhmJTjxxxxxxxxxxxxxxxxxxxxx","code_verifier":"GmmYgxiVRpMYplo3xxxxxxxxxxxxxxxxxxxxxxxxxxx"}' -H 'Content-Type: application/json' https://api.etsy.com/v3/public/oauth/token


    # A successful return value will be a single line on the command line.
      # Formatted it will look something like this.
      {
        "access_token":"12345678.fswLzGhaZ2jjh3cZ4cxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxGt14r1GB2fX6vxxxxxxxxxxxxxxxxxxxxxxxxx",
        "token_type":"Bearer",
        "expires_in":3600,
        "refresh_token":"12345678.xxxxxxxxxxxxxxxxxxxxCK9tp6cu28xxxxxxxx-WDeSyHMEmvAX1CImkbvex8rheo4SxQQxxxxxxxxxxxxxxxxxxxx",
      }

Phase 3 - refreshing tokens

# AS FAR AS I UNDERSTAND IT

  # An access_token is valid for 1 hour
  # A refresh_token is valid for 90 days
  # A refresh_token is for getting new access_tokens without having to do all of the previous steps
  # When you refresh an access_token you also get a new refresh_token (I'm assuming that it restarts the 90 days)

  # To get a new access_token after (or just before) it expires you need make a POST with these parameters.
    # "grant_type"    - Is literally "grant_type":"refresh_token",
    # "refresh_token" - The refresh_token value from the end of "Phase 2"
    # "client_id"     - AKA "keystring" from the Etsy app approval.


  NOTE: THE FIRST KEY:VALUE IS LITERALLY "grant_type": "refresh_token"
  {
    "grant_type": "refresh_token",
    "refresh_token": "12345678.xxxxxxxxxxxxxxxxxxxxCK9tp6cu28xxxxxxxx-WDeSyHMEmvAX1CImkbvex8rheo4SxQQxxxxxxxxxxxxxxxxxxxx",
    "client_id":"put_your_client_id_here"
  }

  # Take out all of the newlines in the JSON object and add it to a single line cURL POST request.
  # Then copy and paste on the command line.

  curl -d '{"grant_type": "refresh_token","refresh_token": "12345678.xxxxxxxxxxxxxxxxxxxxCK9tp6cu28xxxxxxxx-WDeSyHMEmvAX1CImkbvex8rheo4SxQQxxxxxxxxxxxxxxxxxxxx","client_id":"put_your_client_id_here"}' -H 'Content-Type: application/json' https://api.etsy.com/v3/public/oauth/token


  # A successful return value will be a single line on the command line
  # Formatted it will look something like the this object (below).
    # Save these for the next refresh.
    # For subsequent refreshes repeat Phase 3 with the below values.

  {
    "access_token":"1234578.your_new_access_token_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "token_type":"Bearer",
    "expires_in":3600,
    "refresh_token":"12345678.your_new_refresh_token_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  }

valentina-inumi · 2023-01-13T05:24:17Z

valentina-inumi
Jan 13, 2023
Author

Thank you very much for your extensive reply! I'll check if it works (might take some days) and report back.

3 replies

Makebuildmodify Jan 13, 2023

You're welcome. Good luck!

valentina-inumi Jan 19, 2023
Author

Thanks a lot, it worked!
Only in Phase 2 you write it's a get request to get oauth tokens for the first time, but it should be post with this x-www-form-urlencoded content type. Not sure if it works for you with get, didn't try it.
After following your readme the Etsy's one is understandable as well, you saved me a lot of time :)
If you're into stuff I make on Etsy, please DM me there and pick one. Free of charge, that is. Maybe next week, I'm still on holidays :D.

Makebuildmodify Jan 20, 2023

That's great to hear! I changed the "GET/POST" typo just in case somebody else need to use it.

Thanks for letting me know that my notes worked. I wasn't sure if they would make sense to anyone but me.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v3 authentication- any simpler way? #818

{{title}}

Replies: 3 comments 7 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

v3 authentication- any simpler way? #818

valentina-inumi Jan 12, 2023

Replies: 3 comments · 7 replies

Gareth064 Jan 12, 2023

valentina-inumi Jan 13, 2023 Author

Makebuildmodify Jan 13, 2023

Makebuildmodify Jan 13, 2023

valentina-inumi Jan 13, 2023 Author

Makebuildmodify Jan 13, 2023

READ ME

Steps to get Etsy API v3 access Tokens

Phase 0 - Set up

Phase 1 - Getting consent from the "User"

Phase 1.5 - Request for access grant from User

Phase 2 - request OAuth tokens

Phase 3 - refreshing tokens

valentina-inumi Jan 13, 2023 Author

Makebuildmodify Jan 13, 2023

valentina-inumi Jan 19, 2023 Author

Makebuildmodify Jan 20, 2023

valentina-inumi
Jan 12, 2023

Replies: 3 comments 7 replies

Gareth064
Jan 12, 2023

valentina-inumi Jan 13, 2023
Author

Makebuildmodify
Jan 13, 2023

valentina-inumi Jan 13, 2023
Author

valentina-inumi
Jan 13, 2023
Author

valentina-inumi Jan 19, 2023
Author