OAuth 2.0 authorization

Approved Solution Providers help automate key parts of a Walmart Marketplace business, such as inventory management and order processing, using secure OAuth 2.0 authorization.

The Walmart Marketplace app store authorization workflow uses an industry-standard OAuth 2.0 token-based model for authentication and authorization. This workflow allows a seller to grant a third-party application access to protected data in Seller Center without sharing credentials.

This token-based authentication process reduces the number of required headers per API call and simplifies integration with Walmart APIs.

Actors involved in the authorization flow

This authorization workflow involves three actors. Together, they enable a seller to grant a third-party application secure, limited access to protected resources in Seller Center using OAuth 2.0.

Authorization workflow

This section illustrates the authorization workflow with a diagram and provides detailed descriptions of each step in the application connection process. The overview below maps directly to the detailed steps that follow.

1. The seller finds and connects an approved solution provider in Seller Center. (Step 1)
2. The seller signs in and authorizes the application. (Step 2)
3. Walmart authenticates the seller and redirects the browser to the solution provider with an authorization code. (Step 3)
4. The solution provider exchanges the authorization code for an access token and refresh token. (Step 3a–3b)
5. The solution provider uses the access token to make API calls on behalf of the seller.
6. When the access token expires, the solution provider uses the refresh token to obtain a new access token. (Step 3c–3d)

Workflow process diagram

This diagram explains the authorization process between the Walmart app store on Seller Center and Authorization servers:

Step 1: Find and connect an approved Solution Provider (Seller)

After logging in to Walmart Seller Center, you can explore applications that are part of the Walmart Marketplace ecosystem.

To connect an application and initiate the OAuth flow:

1. Log in to Walmart Seller Center.
2. Navigate to Apps.

3. Choose an app and click Connect.
   After you click connect, Walmart loads the approved solution provider’s App Log-in URL, gathered via the application registration process, into your web browser, by adding the following query parameter:

For example:
https://example-client-app.com/login?walmartCallbackUri=https://login.account.wal-mart.com/authorize

Step 2: Sign in and authorize access (Seller)

1. Sign in to the approved Solution Provider's partner site.
2. Select Walmart under Integrations.
3. Sign in to Walmart Seller Center with your access credentials.
4. Select Authorize to connect the partner application to your Walmart Seller Center.
5. After you are authorized, verify to ensure Walmart is added under Available integrations.

OAuth 2.0 flow illustration with Partner site entry

The App Log-in URL and Auth Callback URL might vary depending on applications. All parameters are mandatory unless specified as optional.

The approved solution provider redirects the seller’s browser to Walmart’s authorization endpoint with the following parameters:

For example:

https://login.account.wal-mart.com/authorize?responseType=code&clientId=66874dfd-1d5g-476v-8k2c-e22g46c6727k&redirectUri=https://example-client-app.com/resource/applanding& nonce=AVE1DCZ5FG&state=A0YFFJJQMD&clientType=seller

The nonce is a randomly generated value used during the authorization redirect to prevent replay attacks. It is not required for token API calls. For example, 22e0688e, 91d86d9, or 1opjmhumpr. This parameter is utilized solely in the process of authorization redirect, providing an extra layer of security. It’s important to note that the nonce is not necessary for other API calls such as those involving access tokens or refresh tokens.

This video demonstrates where to find your connect your approved Solution Provider.In this video, we’ll show you how to find and connect with an approved Solution Provider and how to review the data you authorize them to access.

Step 3: Receive authorization code (Approved Solution provider)

After the seller grants access, Walmart redirects the browser to the solution provider’s Auth Callback URL with an authorization code.

For example:

https://example-client-app.com/resource/applanding? code=4B582420568D428A931E4D6750%5B…%5Dr&type=auth&clientId=66874dfd-1d5g-476v-8k2c-e22g46c6727k&sellerId=456782346&state=A0YFFJJQMD

The Approved Solution Provider’s app:

• Validates the state value
• Stores the sellerId and the authorization code

Step 3a: Exchange authorization code for tokens (Solution provider)

The solution provider exchanges the authorization code for an access token and refresh token.

The solution provider’s app calls the Walmart API server to get the OAuth access token and refresh token using the authorization code, sellerId, and application credentials.

Request body:

Step 3b: Receive access token and refresh token response (Solution provider)

The Walmart API server returns the OAuth access token and refresh token.

The response includes access_token, refresh_token, token_type, and expires_in in JSON format.

The solution provider’s app updates the sellerId and the authorization code mapping with the sellerId and refresh token to make requests to the Walmart Marketplace APIs.

Step 3c: Refresh access token (Solution provider)

• An access token expires after 15 minutes, so you must refresh a user’s access token when it expires. You can use the refresh token, obtained from the token API call using the authorization code grant type, to get a new access token. Refresh tokens remain valid for one year.
  • Request URI: https://marketplace.walmartapis.com/v3/token
  • Request method: POST

Request headers:

Request body:

Step 3d: Receive new access token (Solution provider)

The response includes access_token, token_type and expires_in in JSON format.

Summary

The authorization workflow enables secure, token-based access to Walmart Marketplace APIs without sharing seller credentials:

• A seller grants an approved solution provider access through OAuth 2.0 authorization.
• Walmart authenticates the seller and issues an authorization code.
• The solution provider exchanges the authorization code for an access token and refresh token.
• The solution provider uses the access token to call Walmart Marketplace APIs on behalf of the seller.
• Access tokens expire periodically and must be refreshed.