Endpoints

Exchange Authorization Code

Exchanges a short-lived authorization code (obtained from /oauth/authorize) or a refresh_token for a store-scoped access_token (blnk_live_... or blnk_test_...).

Supports both application/json and application/x-www-form-urlencoded request bodies, as well as HTTP Basic Authentication (Authorization: Basic base64(client_id:client_secret)) and PKCE (code_verifier).

Supported Grant Types:

authorization_code: Exchange a 5-minute single-use code for an access_token and refresh_token.
refresh_token: Rotate an existing refresh_token for a new access_token and refresh_token pair.

POST

api

oauth

token

Exchange Authorization Code

curl --request POST \
  --url https://app.blink.store/api/oauth/token \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "authorization_code",
  "client_id": "blnk_client_c35awnC5stJvE1aMvZYHMBpH",
  "client_secret": "blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL",
  "code": "blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c",
  "redirect_uri": "https://partner.com/oauth/blink/callback",
  "code_verifier": "<string>",
  "refresh_token": "<string>"
}
'

import requests

url = "https://app.blink.store/api/oauth/token"

payload = {
    "grant_type": "authorization_code",
    "client_id": "blnk_client_c35awnC5stJvE1aMvZYHMBpH",
    "client_secret": "blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL",
    "code": "blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c",
    "redirect_uri": "https://partner.com/oauth/blink/callback",
    "code_verifier": "<string>",
    "refresh_token": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    grant_type: 'authorization_code',
    client_id: 'blnk_client_c35awnC5stJvE1aMvZYHMBpH',
    client_secret: 'blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL',
    code: 'blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c',
    redirect_uri: 'https://partner.com/oauth/blink/callback',
    code_verifier: '<string>',
    refresh_token: '<string>'
  })
};

fetch('https://app.blink.store/api/oauth/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.blink.store/api/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'grant_type' => 'authorization_code',
    'client_id' => 'blnk_client_c35awnC5stJvE1aMvZYHMBpH',
    'client_secret' => 'blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL',
    'code' => 'blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c',
    'redirect_uri' => 'https://partner.com/oauth/blink/callback',
    'code_verifier' => '<string>',
    'refresh_token' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.blink.store/api/oauth/token"

	payload := strings.NewReader("{\n  \"grant_type\": \"authorization_code\",\n  \"client_id\": \"blnk_client_c35awnC5stJvE1aMvZYHMBpH\",\n  \"client_secret\": \"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL\",\n  \"code\": \"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c\",\n  \"redirect_uri\": \"https://partner.com/oauth/blink/callback\",\n  \"code_verifier\": \"<string>\",\n  \"refresh_token\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.blink.store/api/oauth/token")
  .header("Content-Type", "application/json")
  .body("{\n  \"grant_type\": \"authorization_code\",\n  \"client_id\": \"blnk_client_c35awnC5stJvE1aMvZYHMBpH\",\n  \"client_secret\": \"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL\",\n  \"code\": \"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c\",\n  \"redirect_uri\": \"https://partner.com/oauth/blink/callback\",\n  \"code_verifier\": \"<string>\",\n  \"refresh_token\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.blink.store/api/oauth/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"grant_type\": \"authorization_code\",\n  \"client_id\": \"blnk_client_c35awnC5stJvE1aMvZYHMBpH\",\n  \"client_secret\": \"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL\",\n  \"code\": \"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c\",\n  \"redirect_uri\": \"https://partner.com/oauth/blink/callback\",\n  \"code_verifier\": \"<string>\",\n  \"refresh_token\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "access_token": "blnk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0",
  "token_type": "Bearer",
  "refresh_token": "blnk_rt_z9y8x7w6v5u4t3s2r1q0p9o8n7m6l5k4j3i2h1g0",
  "scope": "products:read orders:read webhooks:write",
  "store": {
    "id": "54ba8e0a-ba35-4609-902e-0ec0b236ac81",
    "name": "Acme Digital Store",
    "subdomain": "acme",
    "custom_domain": "store.acme.com",
    "currency": "usd",
    "mode": "live"
  }
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code has expired"
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code has expired"
}

Body

grant_type

enum<string>

required

Must be authorization_code when exchanging a code from /oauth/authorize, or refresh_token when rotating tokens.

Available options:

authorization_code,

refresh_token

Example:

"authorization_code"

client_id

string

required

Your OAuth application's Client ID (blnk_client_...).

Example:

"blnk_client_c35awnC5stJvE1aMvZYHMBpH"

client_secret

string

Your OAuth application's Client Secret (blnk_secret_...). Required unless using PKCE without a client secret.

Example:

"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL"

code

string

The 5-minute single-use authorization code (blnk_code_...) received at your redirect_uri. Required when grant_type=authorization_code.

Example:

"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c"

redirect_uri

string

The exact redirect_uri used during the /oauth/authorize request.

Example:

"https://partner.com/oauth/blink/callback"

code_verifier

string

Optional PKCE code verifier matching the code_challenge sent to /oauth/authorize.

refresh_token

string

The refresh token (blnk_rt_...) to rotate. Required when grant_type=refresh_token.

Response

Successfully issued or rotated OAuth access token.

access_token

string

The store-scoped Bearer token used to call /api/v1/* endpoints. Does not expire unless revoked or rotated.

Example:

"blnk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0"

token_type

string

Example:

"Bearer"

refresh_token

string

Refresh token (blnk_rt_...) that can be used with grant_type=refresh_token to rotate the access token.

Example:

"blnk_rt_z9y8x7w6v5u4t3s2r1q0p9o8n7m6l5k4j3i2h1g0"

scope

string

Space-separated list of granted scopes (or * for full store access).

Example:

"products:read orders:read webhooks:write"

store

object

Show child attributes

Exchange Authorization Code

curl --request POST \
  --url https://app.blink.store/api/oauth/token \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "authorization_code",
  "client_id": "blnk_client_c35awnC5stJvE1aMvZYHMBpH",
  "client_secret": "blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL",
  "code": "blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c",
  "redirect_uri": "https://partner.com/oauth/blink/callback",
  "code_verifier": "<string>",
  "refresh_token": "<string>"
}
'

import requests

url = "https://app.blink.store/api/oauth/token"

payload = {
    "grant_type": "authorization_code",
    "client_id": "blnk_client_c35awnC5stJvE1aMvZYHMBpH",
    "client_secret": "blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL",
    "code": "blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c",
    "redirect_uri": "https://partner.com/oauth/blink/callback",
    "code_verifier": "<string>",
    "refresh_token": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    grant_type: 'authorization_code',
    client_id: 'blnk_client_c35awnC5stJvE1aMvZYHMBpH',
    client_secret: 'blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL',
    code: 'blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c',
    redirect_uri: 'https://partner.com/oauth/blink/callback',
    code_verifier: '<string>',
    refresh_token: '<string>'
  })
};

fetch('https://app.blink.store/api/oauth/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.blink.store/api/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'grant_type' => 'authorization_code',
    'client_id' => 'blnk_client_c35awnC5stJvE1aMvZYHMBpH',
    'client_secret' => 'blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL',
    'code' => 'blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c',
    'redirect_uri' => 'https://partner.com/oauth/blink/callback',
    'code_verifier' => '<string>',
    'refresh_token' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.blink.store/api/oauth/token"

	payload := strings.NewReader("{\n  \"grant_type\": \"authorization_code\",\n  \"client_id\": \"blnk_client_c35awnC5stJvE1aMvZYHMBpH\",\n  \"client_secret\": \"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL\",\n  \"code\": \"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c\",\n  \"redirect_uri\": \"https://partner.com/oauth/blink/callback\",\n  \"code_verifier\": \"<string>\",\n  \"refresh_token\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.blink.store/api/oauth/token")
  .header("Content-Type", "application/json")
  .body("{\n  \"grant_type\": \"authorization_code\",\n  \"client_id\": \"blnk_client_c35awnC5stJvE1aMvZYHMBpH\",\n  \"client_secret\": \"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL\",\n  \"code\": \"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c\",\n  \"redirect_uri\": \"https://partner.com/oauth/blink/callback\",\n  \"code_verifier\": \"<string>\",\n  \"refresh_token\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.blink.store/api/oauth/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"grant_type\": \"authorization_code\",\n  \"client_id\": \"blnk_client_c35awnC5stJvE1aMvZYHMBpH\",\n  \"client_secret\": \"blnk_secret_Yje9xK2mPqL8vN4rT6wZ1aB3cD5eF7gH9iJ0kL\",\n  \"code\": \"blnk_code_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c\",\n  \"redirect_uri\": \"https://partner.com/oauth/blink/callback\",\n  \"code_verifier\": \"<string>\",\n  \"refresh_token\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "access_token": "blnk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0",
  "token_type": "Bearer",
  "refresh_token": "blnk_rt_z9y8x7w6v5u4t3s2r1q0p9o8n7m6l5k4j3i2h1g0",
  "scope": "products:read orders:read webhooks:write",
  "store": {
    "id": "54ba8e0a-ba35-4609-902e-0ec0b236ac81",
    "name": "Acme Digital Store",
    "subdomain": "acme",
    "custom_domain": "store.acme.com",
    "currency": "usd",
    "mode": "live"
  }
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code has expired"
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code has expired"
}

Getting Started

Developer Tools

Core

Financials

Growth & Marketing

Webhooks & Events

OAuth 2.0

Exchange Authorization Code

Body

Response