Migrate old tokens to OAuth 2.0

This endpoint enables the migration of old authentication tokens to new OAuth 2.0 tokens. If you were using Zid API with the previous authentication method, you can utilize this endpoint to replace your old tokens with new access and refresh tokens.

As one of the required headers, you need to specify the scopes that your app requires. For your reference, here's a list of available scopes:

#	Scope	English explanation	Arabic explanation
1	`third_abandoned_carts_read`	Read abandoned carts information	قراءة معلومات عربات التسوق المهملة
2	`third_account_read`	Read account information	قراءة معلومات الحساب
3	`third_account_write`	Write account information	تعديل معلومات الحساب
4	`third_catalog_write`	Write catalog information	تعديل معلومات الكتالوج
5	`third_categories_read`	Read categories information	قراءة معلومات التصنيفات
6	`third_categories_write`	Write categories information	تعديل معلومات التصنيفات
7	`third_countries_read`	Read countries information	قراءة معلومات الدول
8	`third_coupons_write`	Write coupons information	تعديل معلومات الكوبونات
9	`third_customers_read`	Read customers information	قراءة معلومات العملاء
10	`third_customers_write`	Write customers information	تعديل معلومات العملاء
11	`third_delivery_options_read`	Read delivery options information	قراءة معلومات خيارات التوصيل
12	`third_delivery_options_write`	Write delivery options information	تعديل معلومات خيارات التوصيل
13	`third_js_write`	Write custom JavaScript code	تعديل كود جافا سكريبت مخصوص
14	`third_order_read`	Read orders information	قراءة معلومات الطلبات
15	`third_order_write`	Write orders information	تعديل معلومات الطلبات
16	`third_payment_read`	Read payment information	قراءة معلومات الدفع
17	`third_product_read`	Read products information	قراءة معلومات المنتجات
18	`third_product_write`	Write products information	تعديل معلومات المنتجات
19	`third_subscription_read`	Read subscription information	قراءة معلومات الاشتراكات
20	`third_vat_read`	Read VAT information	قراءة معلومات ضريبة القيمة المضافة
21	`third_webhook_read`	Read webhooks information	قراءة معلومات المستعرضات
22	`third_webhook_write`	Write webhooks information	تعديل معلومات المستعرضات
23	`third_inventory_read`	Read inventory information	قراءة معلومات المخزون
24	`third_bundle_offers_read`	Read bundle offers information	قراءة معلومات عروض الباقات
25	`third_create_order`	Create orders	إنشاء طلبات
26	`third_product_quantity_write`	Write product quantity information	تعديل معلومات كمية المنتج
27	`third_inventory_write`	Write inventory information	تعديل معلومات المخزون
28	`third_product_stock_read`	Read product stock information	قراءة معلومات مخزون المنتج
29	`third_product_stock_write`	Write product stock information	تعديل معلومات مخزون المنتج

Request

Header Params

Authorization

string

required

Authorization token to authenticate the Partner account. Format: Bearer {authorization}

Client-ID

string

required

Client ID generated from the Partner Dashboard

Client-Secret

string

required

Client Secret generated from the Partner Dashboard

Scopes

array[string]

required

Comma-separated list of scopes your app requires. This parameter is used to validate the scopes during the migration process from the old x_manager_token (generated via direct integration) to the new OAuth 2.0 access_token, ensuring a successful migration with the correct scope limitations.

Allowed values:

third_abandoned_carts_readthird_account_readthird_account_writethird_catalog_writethird_categories_readthird_categories_writethird_countries_readthird_coupons_writethird_customers_readthird_customers_writethird_delivery_options_readthird_delivery_options_writethird_js_writethird_order_readthird_order_writethird_payment_readthird_product_readthird_product_writethird_subscription_readthird_vat_readthird_webhook_readthird_webhook_writethird_inventory_readthird_bundle_offers_readthird_create_orderthird_product_quantity_write

Content-Type

string

optional

Default:

application/json

Body Params application/json

x_manager_tokens

object

optional

A dictionary containing store_id: x_manager_token key-value pairs, where store_id is the unique identifier for a store, and x_manager_token is the corresponding access token. Please check the example.

Additional properties

string

optional

Example

{
  "x_manager_tokens": {
    "123456": "eyJpdiI6Ilg4Mj...4a2NlYmFnIjoiIn0=",
    "162892": "eyJpdiI6IkdMd...ZETLEWNFnIjoiIn0=",
    "789012": "eyJpdiI6IjJhYz...RmMmZlNFnIjoiIn0="
  }
}

Request samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Responses

🟢200Successfully migrated the old tokens and returned the new tokens.

application/json

Body

status

string

optional

tokens

array [object {7}]

optional

store_id

integer

optional

The store ID.

access_token

string

optional

The new access token for the store.

token_type

string

optional

The type of the access token, usually "Bearer".

expires_in

integer

optional

The number of seconds until the access token expires.

authorization

string

optional

A signed JWT (JSON Web Token) containing the Partner's authorization information, including scope and expiration time, to be used for subsequent API calls.

refresh_token

string

optional

The new refresh token to obtain new access tokens once the current ones expire.

error

string

optional

message

object

optional

type

string

optional

code

string

optional

name

string

optional

description

string

optional

Example

{
  "status": "object",
  "tokens": [
    {
      "store_id": 123456,
      "access_token": "eyJpdiI6IlovdU...nWo5FYd4",
      "token_type": "Bearer",
      "expires_in": 31536000,
      "authorization": "eyJ0eXAiOi...5myq0",
      "refresh_token": "def5020007...f25e36"
    },
    {
      "store_id": 162892,
      "access_token": "eyJpdiI6IlovdU...nWo5FYd4",
      "token_type": "Bearer",
      "expires_in": 31536000,
      "authorization": "eyJ0eXAiOi...5myq0",
      "refresh_token": "def5020007...f25e36"
    },
    {
      "store_id": 789012,
      "error": "The requested store was not found"
    }
  ],
  "message": {
    "type": "object",
    "code": "OAUTH_MIGRATION",
    "name": "OAUTH_MIGRATION",
    "description": "Use the new token generated for the respective store to integrate."
  }
}

🟠400Bad request, please check the input parameters.

🟠401Unauthorized, please check your old_token and old_secret.

🔴500Internal server error.