Quickstart

This page takes you from nothing to a successful token request.

Prerequisites

A Flavours account that is allowed to manage integrations: a business owner or manager. Concretely, an admin, a merchant, or a subscriber that is not limited to a single branch. A branch-level user receives 403.
The account password. Flavours asks for it when you create an integration or rotate its secret.
A system that can send an HTTPS POST request with a form-encoded body.

Create the integration in the Flavours web app

Sign in to the Flavours web app and open Applications.
Select the settings (gear) button on the Odoo card. Integration management currently lives on that card, and the integrations you create there are not tied to Odoo: they work for any system. The page lists every integration with its Status, Permissions, Created date, and Last used time.
Select New integration.
Enter an Integration name. Use the name of the system it connects to. Names must be unique within the market.
Choose the Permissions the system needs. Pick each one yourself, or use a ready-made set. Grant only what the system needs; see Scopes.
Select Connect and confirm your password when asked.
The Save your credentials dialog shows the Client ID and the Client secret. Copy both into your secrets manager now.

The secret is shown once

Flavours stores only a hash of the client secret. If you close the dialog without copying it, you cannot recover it. Rotate the secret to get a new one.

Request a token

Send the client ID and client secret to the token endpoint. The request is a POST with a form-encoded body (application/x-www-form-urlencoded).

Field	Value
`grant_type`	`client_credentials`
`client_id`	The client ID from step 1.
`client_secret`	The client secret from step 1.

The token endpoint is at the root of the environment, not under /api/v2. On the test environment the URL is https://api.flavours.sa/dev/oauth/token. See Introduction for the environments.

curl -X POST "https://api.flavours.sa/dev/oauth/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=$FLAVOURS_CLIENT_ID" \
  -d "client_secret=$FLAVOURS_CLIENT_SECRET"

Read the response

A successful request returns HTTP 200:

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.EXAMPLE.EXAMPLE"
}

Field	Type	Description
`token_type`	string	Always `Bearer`.
`expires_in`	integer	Lifetime of the token in seconds. At most `3600` (one hour).
`access_token`	string	The token. Treat it as an opaque string and never parse it.

The token endpoint does not use the standard Flavours response envelope (meta and data). It returns the OAuth 2.0 body shown above, and OAuth error bodies on failure. See Errors.

There is no refresh token. When the token expires, request a new one with the same client ID and secret.

What to do next

Store the token in memory and reuse it until shortly before it expires: Token lifecycle.
Handle failures: Errors.
Store credentials safely: Security best practices.

What the token can call today

No business endpoint accepts an integration access token yet, so a successful token request is the end of the flow for now. New endpoints are announced in the Changelog and get their own page in this section. See the Overview.

Prerequisites

Create the integration in the Flavours web app

Request a token

Read the response

What to do next

On this page