Authorization

Your retailer configuration includes the list of APIs and capabilities (collectively called APIs) that your organization has permission to use. When your site generates an access token to authenticate with Foodin platform, you specify which API you want to access by setting the scope. The generated access token is limited to that API.

Generate an access token

POST api.foodin.ai/oauth/token;

Returns an access token. The access token must be included in all other requests as a Bearer token for authentication purposes. Before you begin, ensure you have a client ID and secret from Foodin. You need to pass these values in the request.

Specify the scope and grant type that is required for the API you intend to use.

Request

Request examples

const axios = require("axios");
 
async function getToken() {
  try {
    const response = await axios({
      method: "post",
      url: "https://api.foodin.ai/oauth/token",
      headers: {
        Accept: "application/json",
        "Content-Type": "application/json",
      },
      data: {
        client_id: "string",
        client_secret: "string",
        grant_type: "string",
        scope: "string",
        code: "string",
        redirect_uri: "string",
        assertion: "string",
      },
    });
    console.log(response.data);
  } catch (error) {
    console.error(error);
  }
}
 
getToken();

Response

Response example

{
  "access_token": "mhtEdMZYPypuW_I0fYken8cAqE7llDaoNefHSeVj9u4",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "connect:fulfillment",
  "created_at": 1603897760
}

Authentication errors

Revoke an access token

POST api.foodin.ai/oauth/token/revoke

Revokes any access token. You need to include your client ID and secret and the access token in the request body.

const axios = require("axios");
 
async function revokeToken() {
  try {
    const response = await axios({
      method: "post",
      url: "https://api.foodin.ai/oauth/token/revoke",
      headers: {
        Accept: "application/json",
        "Content-Type": "application/json",
      },
      data: {
        client_id: "string",
        client_secret: "string",
        token: "string",
      },
    });
    console.log(response.data);
  } catch (error) {
    console.error(error);
  }
}
 
revokeToken();

Response examples

200 success

{
  // Empty
}

Authentication for event callbacks

To enable event callbacks to be sent to your retailer site, OAuth v2.0 must be enabled on the callback endpoint. For information about OAuth 2.0, see the OAuth 2.0 Authorization Framework (RFC).

OAuth 2.0 details required Foodin requires the following configuration details to support callbacks:

• An endpoint to use for Connect callbacks. The endpoint must be protected by OAuth 2.0.
• An endpoint to use for OAuth 2.0 authentication, which accepts a form POST with content type application/x-www-form-urlencoded and the following query parameters:

Response requirements

Process

Foodin Connect requests an access token to begin sending callback events. When the access token expires, Connect requests a new token.

• Connect uses the OAuth 2.0 endpoint to send a request for an access token.
• The retailer site returns an access token.
• Connect uses the callback endpoint to send the callback along with the access token.
• The retailer site authenticates the request and permits the callback.