[Important] Open Platform Authorization Flow Improvement

Dear Developers,

Please note the following improvements of authorization and cancel authorization flow:

To improve the integration efficiency of the authorization flow, platform provides a new authorization and cancel authorization link generation method.

The new authorization link comprises a Fixed Authorization URL and Other Required Parameters, the logic is as follows:

Fixed Authorization URL:

- Live Environment:

https://open.shopee.com/auth
https://open.shopee.cn/auth
https://open.shopee.com.br/auth

- Sandbox Environment:

https://open.test-stable.shopee.com/auth
https://open.test-stable.shopee.cn/auth
https://open.test-stable.shopee.com.br/auth

Other Required Parameters:

Name	Type	Required	Description
partner_id	int	True	The partner_id of your application, assigned by Shopee Open Platform.
auth_type	string	True	The type of roles need to authorize, the enumeration values are as follows: - seller: if you need to authorize shop or merchant, please select seller; - supplier: if you need to authorize supplier, please select supplier.
redirect_uri	string	True	The URL used for receiving the code after seller completes the authorization. The domain of redirect_uri must be consistent with the domain declared when you create and go live the application on Shopee Open Platform.
response_type	string	True	The authorization type, with the value of "code".
state	string	False	An unguessable random string for protecting against cross-site request forgery attacks, the original value will be called back to redirect_uri after authorization is complete.

Examples of authorization link:

- Live Environment: https://open.shopee.com/auth?partner_id=10090&auth_type=seller&redirect_uri=https://open.shopee.com&response_type=code

- Sandbox Environment: https://open.test-stable.shopee.com/auth?partner_id=1000016&auth_type=seller&redirect_uri=https://open.test-stable.shopee.com&response_type=code

The new cancel authorization link is generated in the same way as the new authorization link, but the Fixed Authorization URL needs to be changed to a Fixed Cancel Authorization URL, the logic is as follows:

Fixed Cancel Authorization URL:

- Live Environment:

https://open.shopee.com/cancel_auth
https://open.shopee.cn/cancel_auth
https://open.shopee.com.br/cancel_auth

- Sandbox Environment:

https://open.test-stable.shopee.com/cancel_auth
https://open.test-stable.shopee.cn/cancel_auth
https://open.test-stable.shopee.com.br/cancel_auth

Examples of cancel authorization link:

- Live Environment: https://open.shopee.com/cancel_auth?partner_id=10090&auth_type=seller&redirect_uri=https://open.shopee.com&response_type=code

- Sandbox Environment: https://open.test-stable.shopee.com/cancel_auth?partner_id=1000016&auth_type=seller&redirect_uri=https://open.test-stable.shopee.com&response_type=code

Note: The old authorization & cancel authorization link generation method can still be used, please choose whether to migrate to the new authorization & cancel authorization link generation method according to your own needs.

To protect the seller's data security, platform adds the domain verification for the redirect url in the authorization and cancel authorization link. All developers need to declare the Test Redirect URL Domain and Live Redirect URL Domain in Console for each APP.

After the declaration is completed, if the domain corresponding to the redirect_uri or redirect passed in when generating authorization and cancel authorization links is not consistent with the domain declared in Console, will return the error message: The domain of redirect_uri is not consistent with the Redirect URL Domain declared in console.

Notes: 1) The domain verification is also applicable to the old authorization and cancel authorization link generation method; 2) For APPs that have been created before and have not declared the Test Redirect URL Domain and Live Redirect URL Domain, please log in to Console and visit the APP editing page as soon as possible to make the declaration. Before the declaration is completed, platform will not perform the domain verification, so it will not affect the existing authorization and cancel authorization flow.

To support sellers to set the authorization period more flexibly, platform supports sellers to customize the authorization expiration date when authorizing. The authorization period is no longer fixed at 365 days.

After clicking the “Confirm Authorization” button on the authorization page, the authorization period selector will appear, seller can choose the authorization period as 7 Days, 30 Days, 90 Days, 180 Days, 365 Days, and if the above options can meet the seller's needs, seller can choose Customized Expiration Date and then select any time within 365 days.

Cross-border main account authorization page updates

We have updated the UI for the cross-border main account authorization page. Sellers need to now click "Authorize Merchant" after expanding the shop list under a merchant. If sellers doesn't check the authorization box, a pop-up reminder will appear.

Effective Date on Live:

Lived on 2024.05.23

尊敬的开发者：

请留意以下授权&取消授权流程优化：

为了提升授权流程的对接效率，平台提供了一种新的授权链接&取消授权链接生成方式。

1）新的授权链接由固定授权URL和其他所需参数拼接而成，逻辑如下：

固定授权URL:

- 生产环境：

https://open.shopee.com/auth
https://open.shopee.cn/auth
https://open.shopee.com.br/auth

- 沙箱测试环境：

https://open.test-stable.shopee.com/auth
https://open.test-stable.shopee.cn/auth
https://open.test-stable.shopee.com.br/auth

其他所需参数:

Name	Type	Required	Description
partner_id	int	True	The partner_id of your application, assigned by Shopee Open Platform.
auth_type	string	True	The type of roles need to authorize, the enumeration values are as follows: - seller: if you need to authorize shop or merchant, please select seller; - supplier: if you need to authorize supplier, please select supplier.
redirect_uri	string	True	The URL used for receiving the code after seller completes the authorization. The domain of redirect_uri must be consistent with the domain declared when you create and go live the application on Shopee Open Platform.
response_type	string	True	The authorization type, with the value of "code".
state	string	False	An unguessable random string for protecting against cross-site request forgery attacks, the original value will be called back to redirect_uri after authorization is complete.

授权链接样例:

- 生产环境：https://open.shopee.com/auth?partner_id=10090&auth_type=seller&redirect_uri=https://open.shopee.com&response_type=code

- 沙箱测试环境：https://open.test-stable.shopee.com/auth?partner_id=1000016&auth_type=seller&redirect_uri=https://open.test-stable.shopee.com&response_type=code

2）新的取消授权链接，与新的授权链接生成方式一致，但是固定授权URL需要变为固定取消授权URL，逻辑如下：

固定取消授权URL:

- 生产环境：

https://open.shopee.com/cancel_auth
https://open.shopee.cn/cancel_auth
https://open.shopee.com.br/cancel_auth

- 沙箱测试环境：

https://open.test-stable.shopee.com/cancel_auth
https://open.test-stable.shopee.cn/cancel_auth
https://open.test-stable.shopee.com.br/cancel_auth

取消授权链接样例:

- 生产环境：https://open.shopee.com/cancel_auth?partner_id=10090&auth_type=seller&redirect_uri=https://open.shopee.com&response_type=code

- 沙箱测试环境：https://open.test-stable.shopee.com/cancel_auth?partner_id=1000016&auth_type=seller&redirect_uri=https://open.test-stable.shopee.com&response_type=code

注意：旧的授权链接&取消授权链接生成方式仍然可以继续使用，请根据自身需求选择是否迁移使用新的授权链接生成方式。

为了保护卖家的数据安全，平台针对授权链接&取消授权链接中的回调地址增加了域名校验。

所有开发者都需要在Console为每一个APP申报Test Redirect URL Domain与Live Redirect URL Domain。

申报完成后，若生成授权链接&取消授权链接时传入的回调地址 (redirect_uri, redirect) 对应的域名与Console申报的域名不一致，将会返回报错：The domain of redirect_uri is not consistent with the Redirect URL Domain declared in console.

注意：

1）上述域名校验，针对旧的授权链接&取消授权链接生成方式同样适用；

2）针对历史已经创建的APP，均未申报Test Redirect URL Domain与Live Redirect URL Domain，请各位开发者尽快登陆Console，访问APP编辑页进行申报。申报完成前，平台不会进行上述域名校验，因此不会对现有的授权&取消授权流程造成影响。

为了支持卖家更灵活地设置授权期限，平台支持卖家在授权时自定义授权到期时间。

授权有效期不再是固定的365天。

卖家在授权页面点击“Confirm Authorization”按钮后，将会出现授权时间选择器，可以选择授权时间为7 Days、30 Days、90 Days、180 Days、365 Days，若上述选项均无法满足卖家需求，可以选择Customized Expiration Date，选择365天内的任意时间。

跨境主账号授权页面UI调整

我们已更新跨境主账号授权页面的UI。卖家需要在展开商家店铺列表后点击“授权商家”。如果卖家没有勾选授权框，将会弹出提醒窗口。

上线时间：

2024.05.23 已上线

[Important] Open Platform Authorization Flow Improvement

资料正文

§1 [Important] Open Platform Authorization Flow Improvement