Authorization page updates

To comply with GDPR ruling, there are changes coming to the app installation and authorization workflow. When creating an application, developers are now required to select API scopes their application will need to function as expected. Sellers are then shown the same list of scopes when installing the application, and are given the option to reject the authorization request. This is a major change from the previous flow where apps were implicitly granted all scopes and the seller was shown all options with no obvious way to reject the authorization request.

This change is for all markets.

This change affects all sellers (both local and cross border).

This change is for the Access Token endpoint, which is applicable for all versions.

Applications that are already authorized will continue to work until the authorization expires. Applications that are new or have expired authorization:

1. The scopes for the app need to be selected in Partner Center.
2. The API request to get the access token must include the scopes in the request
3. The response will contain the scopes that were granted
4. Existing sellers who have authorized the application will need to renew their authorization before the scopes can take effect.
5. When they do this, only the scopes that have been selected by the developer will be shown during the flow.
6. Redirect URL will contain the code if everything is working well
7. In case of an error, there will be error=access_denied added to the redirect URL query parameters.

Any APIs that are called without scopes associated with the access token will fail with a 401 status code.

Get Access Token API Changes

Parameters

No changes

Responses

A new array of strings titled granted_permissions will be present in the response body. These strings represent the scopes the user has authorized to access and are in upper snake case (ex ["MANAGE_GLOBAL_PRODUCTS", "LIVEROOM_INFO"]).

Seller App Authorization Flow Changes

Sellers will see the scopes that the developer has chosen when installing an application. Before this change, the seller had no choice to reject the connection and was forced to install the application. Now there is a new "Discard" button that they can click which will cancel the installation process. In this situation, the system will redirect to the URL specified by the application and will include error=access_denied&code=null as query parameters.

Change Summary