What can I do if I don't save the new "access_token" and "refresh_token"?

What can I do if I don't save the new "access_token" and "refresh_token"?

"refresh_token" Backup Plan

1. A valid "refresh_token" can be used more than once. After the 1st time when you input it into the API request, it will be valid for the next 4 hours. If you continue to use the same old "refresh_token" in subsequent queries, the same new "refresh_token" will always be returned in the response.

2. After 4 hours, the old "refresh_token" will expire. By the time, if you have not got the new "refresh_token", you can only leverage the Resend Code Function or contact the seller to authorize your App again to get a new "code" and get a couple of new "refresh_token" and "access_token" with the new "code".

3. Once the new "refresh_token" is used, the old "refresh_token" will expire, because it means you have already saved the new "refresh_token".

For example:

You use the "code" to get "refresh_token" 1 and pass the "refresh_token" 1 in the request of the "v2.public.refresh_access_token" API call to get a new "refresh_token" 2. "refresh_token" 2 is available for the next 30 days, whereas "refresh_token" 1 is valid for the next 4 hours.

At this time, there will be 2 valid "refresh_token" under the same authorization.

If you haven't got the new "refresh_token" 2, you can still use "refresh_token" 1 to call the "v2.public.refresh_access_token" API. For the next 4 hours, "refresh_token" 1 will be valid and whenever you call the "v2.public.refresh_access_token" API with "refresh_token" 1,only the same "refresh_token" 2 will be returned.

If you have got the new "refresh_token" 2, you can use it to call the "v2.public.refresh_access_token" API in 30 days. After using "refresh_token" 2 to call the "v2.public.refresh_access_token" API, you will get a new "refresh_token" 3 and "refresh_token" 1 will expire. "refresh_token" 3 will be available for the next 30 days and "refresh_token" 2 will be available for 4 hours. Calling the "v2.public.refresh_access_token" API with "refresh_token" 2 will only return the same "refresh_token" 3.

** Using "resend_code" or contacting the seller to get a new "code" and then using it to call the "v2.public.get_access_token" API is equivalent to refreshing the "access_token".

For example, after using "refresh_token" 2 to get "refresh_token" 3, if you use "resend_code" or contact the seller to get the "code" and use it to call the "v2.public.get_access_token" API, you will get a "refresh_token" 4 which is available for 30 days, whereas "refresh_token" 3 will be available for 4 hours and "refresh_token" 2 will expire at once.

Resend Code Function

Background: In order to improve the user experience of the v2.0 authorization process and reduce the impact on sellers when developers cannot obtain tokens due to technical failures, Shopee has implemented a resend code authorization process that allows developers to resend the required code for shop authorization on behalf of sellers by logging into their developer accounts.

The process is as follows

1. Generate a management link for shop authorization by adding the parameter "is_developer=1" at the end of the original V2 authorization link

For example

https://partner.shopeemobile.com/api/v2/shop/auth_partner?partner_id=851264&redirect=https://www.baidu.com/&timestamp=1641452604&sign=6ac3d502a147e30c796705b02eeea950842cb678230e4f7bf35a32369439cb78&is_developer=1

Noted:

• This function is only available in production environment, not in sandbox/test-stable environment.
• v1 authorization link is not applicable; only v2 authorization link is supported.

2. After jumping the link, you are requested to log into your developer account.

3. After successful login, you may choose either Shop ID or Merchant ID from the drop-down menu, and then enter the "shop_id" of the shop or "merchant_id" of the merchant that you want to re-authorize (currently you can only enter one "shop_id" or one "merchant_id" at one time).

4.Click the button, resend authorized code, and then click confirm

Noted:

• The "resend authorized code" button will be displayed if the shop status is under authorization (auth) or authorization is frozen (frozen).
• If the shop status is expired or the authorization has been unbounded (deauth), the "resend authorized code" button won't be displayed.

5. A URL with a "code" ("resend_code") will be returned in your browser.

For example​​

https://www.baidu.com/?code=resend6a4d636f656a556a677351625050614c

6. Call the "v2.public.get_token_by_resend_code" API with the returned "resend_code" to get the latest "refresh_token" and "access_token"

Noted:

• The "resend_code" can only be used once, and valid for 10 minutes.
• You can't call the" v2.public.refresh_access_token" API with a "resend_code" to get the "refresh_token" and "access_token".
• You can't call the "v2.public.get_token_by_resend_code" API with a normal "code" (not "resend_code").