Creating OAuth clients

Each third party you share with gets its own OAuth client: a client ID and a client secret it uses to ask merchants for access and to get tokens.

Once account sharing is enabled for your application, the Developer tab has a section for creating OAuth clients. Create one per third party, in each environment it needs: a sandbox client only works with sandbox accounts, and a live client with live accounts.

Give the third party:

• The client ID and client secret
• A link to Connecting to shared accounts, which describes the flow they implement

Treat the client secret like an API key: send it securely, and create a new client if it may have leaked.

A third party can only reach accounts that their merchant has connected to the Merchant Portal and then chosen during the flow. Creating a client gives it no access by itself.