Oauth

6 operations. Every schema and example on this page is generated from the platform contract.

GET/api/v1/oauth/consent

What the consent page shows: who is asking, what it may do, and your shops.

Takes the authorization request exactly as /auth/authorize received it, plus the merchant’s own Membber session as a Bearer token. A request that cannot be trusted answers kind "show" (a message) or "redirect" (back to the app).

auth merchant:readop oauthConsentDetailsrate limited errors

Parameters

response_typestringqueryoptional

client_idstringqueryoptional

redirect_uristringqueryoptional

code_challengestringqueryoptional

code_challenge_methodstringqueryoptional

scopestringqueryoptional

statestringqueryoptional

resourcestringqueryoptional

curl -G "https://www.membber.com/api/v1/oauth/consent" \
  -H "Authorization: Bearer $MEMBBER_TOKEN"

import { createMembberClient } from "@membber/sdk-ts";

const membber = createMembberClient({
  getAccessToken: () => process.env.MEMBBER_TOKEN,
});

const { data, error } = await membber.raw.GET("/api/v1/oauth/consent");

if (error) {
  // Typed error envelope: { error: { code, message, requestId } }
  throw new Error(`${error.error.code}: ${error.error.message}`);
}
console.log(data);

import MembberSwift

let client = MembberClient(
    serverURL: MembberClient.productionServerURL,
    tokenProvider: { session.accessToken }
)

let response = try await client.api.oauthConsentDetails().ok.body.json

print(response)

Response, 200

"<value>"

POST/api/v1/oauth/consent

Allow or Cancel on the consent page; answers where to send the person back.

Allow makes (or refreshes) the grant for the one shop and a one-time code. The shop must be one the person reaches today. Cancel sends the app access_denied.

auth merchant:writeop oauthConsentDecisionidempotent retry rate limited errors

Request body

requestobjectrequired

8 child fields

response_typestringoptional

client_idstringoptional

redirect_uristringoptional

code_challengestringoptional

code_challenge_methodstringoptional

scopestringoptional

statestringoptional

resourcestringoptional

decisionenumrequired

allowcancel

store_idstring · uuidoptional

The one shop to connect. Required to allow.

Response, 200

redirect_tostringrequired

curl -X POST "https://www.membber.com/api/v1/oauth/consent" \
  -H "Authorization: Bearer $MEMBBER_TOKEN" \
  -H "Idempotency-Key: 1f0e2d3c-4b5a-4678-9abc-def012345678" \
  -H "Content-Type: application/json" \
  -d '{
    "request": {
      "response_type": "<response_type>",
      "client_id": "8e81e60f-0000-4000-8000-d0c50000008e",
      "redirect_uri": "<redirect_uri>",
      "code_challenge": "EXAMPLE10",
      "code_challenge_method": "EXAMPLE10",
      "scope": "<scope>",
      "state": "<state>",
      "resource": "<resource>"
    },
    "decision": "allow"
  }'

import { createMembberClient } from "@membber/sdk-ts";

const membber = createMembberClient({
  getAccessToken: () => process.env.MEMBBER_TOKEN,
});

const { data, error } = await membber.raw.POST("/api/v1/oauth/consent", {
  body: {
    request: {
      response_type: "<response_type>",
      client_id: "8e81e60f-0000-4000-8000-d0c50000008e",
      redirect_uri: "<redirect_uri>",
      code_challenge: "EXAMPLE10",
      code_challenge_method: "EXAMPLE10",
      scope: "<scope>",
      state: "<state>",
      resource: "<resource>"
    },
    decision: "allow"
  },
  headers: { "Idempotency-Key": crypto.randomUUID() },
});

if (error) {
  // Typed error envelope: { error: { code, message, requestId } }
  throw new Error(`${error.error.code}: ${error.error.message}`);
}
console.log(data);

import MembberSwift

let client = MembberClient(
    serverURL: MembberClient.productionServerURL,
    tokenProvider: { session.accessToken }
)

let response = try await client.api.oauthConsentDecision(
    body: .json(.init(
        request: .init(
            responseType: "<response_type>",
            clientId: "8e81e60f-0000-4000-8000-d0c50000008e",
            redirectUri: "<redirect_uri>",
            codeChallenge: "EXAMPLE10",
            codeChallengeMethod: "EXAMPLE10",
            scope: "<scope>",
            state: "<state>",
            resource: "<resource>"
        ),
        decision: .allow
    ))
).ok.body.json

print(response)

Response, 200

{
  "redirect_to": "<redirect_to>"
}

GET/api/v1/oauth/jwks

The authorization server's public signing key (JWKS, ES256).

auth none, publicop oauthJwksrate limited errors

Response, 200

keysarray of objectrequired

curl -G "https://www.membber.com/api/v1/oauth/jwks"

import { createMembberClient } from "@membber/sdk-ts";

const membber = createMembberClient();

const { data, error } = await membber.raw.GET("/api/v1/oauth/jwks");

if (error) {
  // Typed error envelope: { error: { code, message, requestId } }
  throw new Error(`${error.error.code}: ${error.error.message}`);
}
console.log(data);

import MembberSwift

let client = MembberClient(
    serverURL: MembberClient.productionServerURL,
    tokenProvider: { nil }
)

let response = try await client.api.oauthJwks().ok.body.json

print(response)

Response, 200

{
  "keys": [
    {}
  ]
}

POST/api/v1/oauth/register

OAuth Dynamic Client Registration (RFC 7591) for AI apps.

Open registration, as ChatGPT and Claude expect. https redirect URIs, or http on a loopback address only. Registering proves nothing about who the app is: the consent page names it by where it sends the person back.

auth none, publicop oauthRegisteridempotent retry rate limited errors

Request body

redirect_urisarray of stringoptional

client_namestringoptional

client_uristringoptional

token_endpoint_auth_methodstringoptional

grant_typesarray of stringoptional

response_typesarray of stringoptional

scopestringoptional

software_idstringoptional

software_versionstringoptional

curl -X POST "https://www.membber.com/api/v1/oauth/register" \
  -H "Idempotency-Key: 1f0e2d3c-4b5a-4678-9abc-def012345678" \
  -H "Content-Type: application/json" \
  -d '{
    "redirect_uris": [
      "<redirect_uri>"
    ],
    "client_name": "<client_name>",
    "client_uri": "<client_uri>",
    "token_endpoint_auth_method": "<token_endpoint_auth_method>",
    "grant_types": [
      "<grant_type>"
    ],
    "response_types": [
      "<response_type>"
    ],
    "scope": "<scope>",
    "software_id": "36e25ab3-0000-4000-8000-d0c500000036",
    "software_version": "<software_version>"
  }'

import { createMembberClient } from "@membber/sdk-ts";

const membber = createMembberClient();

const { data, error } = await membber.raw.POST("/api/v1/oauth/register", {
  body: {
    redirect_uris: [
      "<redirect_uri>"
    ],
    client_name: "<client_name>",
    client_uri: "<client_uri>",
    token_endpoint_auth_method: "<token_endpoint_auth_method>",
    grant_types: [
      "<grant_type>"
    ],
    response_types: [
      "<response_type>"
    ],
    scope: "<scope>",
    software_id: "36e25ab3-0000-4000-8000-d0c500000036",
    software_version: "<software_version>"
  },
  headers: { "Idempotency-Key": crypto.randomUUID() },
});

if (error) {
  // Typed error envelope: { error: { code, message, requestId } }
  throw new Error(`${error.error.code}: ${error.error.message}`);
}
console.log(data);

import MembberSwift

let client = MembberClient(
    serverURL: MembberClient.productionServerURL,
    tokenProvider: { nil }
)

let response = try await client.api.oauthRegister(
    body: .json(.init(
        redirectUris: ["<redirect_uri>"],
        clientName: "<client_name>",
        clientUri: "<client_uri>",
        tokenEndpointAuthMethod: "<token_endpoint_auth_method>",
        grantTypes: ["<grant_type>"],
        responseTypes: ["<response_type>"],
        scope: "<scope>",
        softwareId: "36e25ab3-0000-4000-8000-d0c500000036",
        softwareVersion: "<software_version>"
    ))
).ok.body.json

print(response)

Response, 200

"<value>"

POST/api/v1/oauth/revoke

OAuth token revocation (RFC 7009): a refresh token revokes its family.

auth none, publicop oauthRevokeidempotent retry rate limited errors

curl -X POST "https://www.membber.com/api/v1/oauth/revoke" \
  -H "Idempotency-Key: 1f0e2d3c-4b5a-4678-9abc-def012345678"

import { createMembberClient } from "@membber/sdk-ts";

const membber = createMembberClient();

const { data, error } = await membber.raw.POST("/api/v1/oauth/revoke", {
  headers: { "Idempotency-Key": crypto.randomUUID() },
});

if (error) {
  // Typed error envelope: { error: { code, message, requestId } }
  throw new Error(`${error.error.code}: ${error.error.message}`);
}
console.log(data);

import MembberSwift

let client = MembberClient(
    serverURL: MembberClient.productionServerURL,
    tokenProvider: { nil }
)

let response = try await client.api.oauthRevoke().ok.body.json

print(response)

Response, 200

"<value>"

POST/api/v1/oauth/token

OAuth token endpoint: authorization_code (PKCE S256) and rotating refresh_token.

Form-encoded. Access tokens are ES256 JWTs, 10 minutes, audience the Membber Business MCP address. Refresh tokens are opaque and rotate on every use; a used one presented again revokes its whole family.

auth none, publicop oauthTokenidempotent retry rate limited errors

curl -X POST "https://www.membber.com/api/v1/oauth/token" \
  -H "Idempotency-Key: 1f0e2d3c-4b5a-4678-9abc-def012345678"

import { createMembberClient } from "@membber/sdk-ts";

const membber = createMembberClient();

const { data, error } = await membber.raw.POST("/api/v1/oauth/token", {
  headers: { "Idempotency-Key": crypto.randomUUID() },
});

if (error) {
  // Typed error envelope: { error: { code, message, requestId } }
  throw new Error(`${error.error.code}: ${error.error.message}`);
}
console.log(data);

import MembberSwift

let client = MembberClient(
    serverURL: MembberClient.productionServerURL,
    tokenProvider: { nil }
)

let response = try await client.api.oauthToken().ok.body.json

print(response)

Response, 200

"<value>"