Transfer authorization and refresh token

5. Walmart passes the authorization code grant to the solution provider.

   Walmart redirects to the Solution Provider’s Auth Callback URL with the following query parameters:

   
   
   

   Parameter	Description
   code	Authorization code that the solution provider app exchange for a refresh token
   type	In this case, type=auth
   clientId	Pre-registered identifier that uniquely identifies a solution provider app. The Walmart authorization server returns the same clientId that is passed by the app
   state	The state value that is passed by the solution provider app
   sellerId	Walmart identifier of the seller who is authorizing the solution provider app

For example:

https://example-client-app.com/resource/applanding? code=4B582420568D428A931E4D6750%5B…%5Dr&type=auth&clientId=66874dfd-1d5g-476v-8k2c-e22g46c6727k&sellerId=456782346&state=A0YFFJJQMD

• The solution provider’s app validates the state value.
• The solution provider’s app saves the sellerId and the authorization code.

6. The solution provider’s exchanges the authorization code for a refresh token.

• The solution provider’s app calls the Walmart API server to get the OAuth access token and refresh token using the authorization code, sellerId, and application credentials.

  • Request URI:

  • Request method: POST

  • Request headers:

    
    

    Parameter	Description	Sample
    WM_PARTNER.ID	SellerId received with authorization code in step 5.	43423324
    WM_MARKET	Optional. Default: us (USA) Available marketplace location: us (USA), mx (Mexico) or ca (Canada)	us, mx or ca
    Authorization	Basic authentication using clientId and client secret of your app.	Basic e3tjbGllbnRfaWR9fTp7e2XR9fQ==
    Content-Type	Content type of the request body.	application/x-www-form-urlencoded
    WM_CONSUMER.CHANNEL.TYPE	Optional. A unique ID to track the consumer request by channel. Use the Consumer Channel Type received during onboarding
    WM_QOS.CORRELATION_ID	A unique ID which identifies each API call and used to track and debug issues; use a random generated GUID for this ID	b3261d2d-028a-4ef7-8602-633c23200af6
    WM_SVC.NAME	Walmart Service Name	Walmart Marketplace

Request body:

7. The Walmart API server returns the OAuth access token and refresh token.

   The response includes access_token, refresh_token, token_type, and expires_in in JSON format.

   
   

   Parameter	Description	Sample
   access_token	Access token to be used for accessing business APIs	eyJraWQiOiI1MWY3MjM0Ny0wYWY5LTRhZ….
   refresh_token	Token which should be used to refresh the access token.	APXcIoTpKMH9OQN…….
   token_type	Token Type	Bearer
   expires_in	Expiry time of the access token in seconds	900

   The solution provider’s app updates the sellerId and the authorization code mapping with the sellerId and refresh token to make requests to the Walmart Marketplace APIs.

8. Fetch the new access token with the refresh token

• An access token expires after a certain interval, so you will have to refresh a user’s access token. You could use the refresh token, obtained from the token API call using the authorization code grant type, to get a new access token. Refresh tokens remain valid for a year.
  • Request URI: https://marketplace.walmartapis.com/v3/token
  • Request method: POST

Request headers:

Request body:

9. Walmart API Server returns the new OAuth access token.

The response includes access_token, token_type and expires_in in JSON format.