Authorization Flows Edit the file on GitHub

Table of Contents

• Generate access_token
  • Application Token
  • User Token
• Consume access_token
• Renew access_token
  • Application Token
  • User Token

Generate access_token

The first thing you need to do before any request which requires authorization is to grab a valid access_token. Depending on your application's needs you either need an application token or a user token.

Keep in mind that a user token can also be used for accessing public resources as well, taken that it was generated containing the public permission in the scope parameter.

Application Token

An implementation of client-credentials, allowing you to access only public resources.

Expires 2 weeks upon creation.

The request signature of an application token request (client_credentials) is the following:

POST https://www.skroutz.gr/oauth2/token

User Token

It grants access to user resources and is generated in two steps. Expires in a day since its creation.

Step 1 - Get an authorization code

The request signature of an authorization code request is the following:

GET https://www.skroutz.gr/oauth2/authorizations/new

If you perform the above request the user will get to see a screen prompting to authorize your application to access the resources you specified in the scope parameter.

Given that the user granted your application the requested permissions, you are then redirected to:

https://your_redirect_uri?code=a_valid_authorization_code

Otherwise you will get redirected to:

https://your_redirect_uri?error=access_denied

Keep in mind that the code will be url-encoded. Please url-decode it before supplying it to the library performing HTTP requests, as the library may url-encode it again, rendering it invalid.

Step 2 - Exchange the authorization code for an oauth_token and a refresh token

The request signature of an access token request is the following:

POST https://www.skroutz.gr/oauth2/token

If the request was successful, the response contains JSON in the following form:

{
  "access_token": "your_access_token",
  "refresh_token": "your_refresh_token",
  "token_type": "bearer",
  "expires_in": 3599
}

Consume access_token

There are 2 ways to specify your access_token in a request.

1. As a parameter

curl -XGET https://api.skroutz.gr/api/search\?\
  q\=apple\&\
  oauth_token=your_access_token_here \
  -H 'Accept: application/vnd.skroutz+json; version=3'

2. As a header

curl -XGET https://api.skroutz.gr/api/search\?q\=apple \
  -H 'Accept: application/vnd.skroutz+json; version=3' \
  -H 'Authorization: Bearer your_access_token_here'

Mind not to use both ways at the same time.

Renew access_token

Any API call with an expired access_token receives an HTTP 401 Unauthorized response.

Application Token

If your application token you're using gets expired you have to get a new one in the exact way you got the last one.

POST https://www.skroutz.gr/oauth2/token

The above request will respond with an existing or a new application token. Notice that in this case you don't need to exchange a refresh token for an application token.

User Token

When a user token gets expired you need to exchange the refresh token you've been given for a new valid token.

POST https://www.skroutz.gr/oauth2/token