Get users credentials from authorization code

[alexandregama]

Goal

Use the authorization code got in the previous step to get your user's credentials through the OAuth API, so you can operate on behalf of him.

Description

You must include these parameters:

• client_secret: Your access_token (private key) that you find in the section Credentials of your account.
• code: The authorization code you got after redirecting the user back to your site.
• redirect_uri: It must be the same Redirect URI you've configured in your application.

Api

You must use the oficial documentation

You can use the following curl command to get your user's credentials

curl -X POST \
     -H 'accept: application/json' \
     -H 'content-type: application/x-www-form-urlencoded' \
     'https://api.mercadopago.com/oauth/token' \
     -d 'client_secret=ACCESS_TOKEN' \
     -d 'grant_type=authorization_code' \
     -d 'code=AUTHORIZATION_CODE' \
     -d 'redirect_uri=REDIRECT_URI'

The answer will have the connected user's credentials as follows:

{
    "access_token": "USER_AT",
    "public_key": "USER_PK",
    "refresh_token": "USER_RT",
    "live_mode": false,
    "user_id": 123456789,
    "token_type": "bearer",
    "expires_in": 15768000,
    "scope": "offline_access read write"
}

Observation

Besides the access_token and the public_key generated to be used as your user's credentials, the answer also has the field expires_in which specifies the time, in seconds, during which these credentials will be valid (15768000 seconds = 6 months), a refresh_token that you must use to renovate them, and your user's MercadoPago account identificator (user_id).

When thing gonna be wrong

You can simulate an error message as follows:

curl -X POST \
     -H 'accept: application/json' \
     -H 'content-type: application/x-www-form-urlencoded' \
     'https://api.mercadopago.com/oauth/token' \
     -d 'client_secret=APP_USR-111111111111-121112-hkj32kjh53nb43jkh43jh4__LB_LA__-200679335' \
     -d 'grant_type=authorization_code' \
     -d 'code=TG-5773abbae4b0cd959919215e-200679335' \
     -d 'redirect_uri=http://localhost:8080/mercado-pago-web-app/connected'

One thing wrong on the code above:

• You may not authorized to use your production credentials. You may receive the message Unauthorized use of live credentials

You'll receive the following message on json:

{
    "message": "Unauthorized use of live credentials",
    "error": "bad_request",
    "status": 400,
    "cause": {
        "code": 5,
        "description": "Unauthorized use of live credentials",
        "data": null
    }
}