Creation

The authorization_code flow is characterized by the intervention of the seller to explicitly authorize the application's access to their data and by the use of a code granted by the authentication server so that the application can obtain an access token and an associated refresh token.

Because it is a redirect-based flow, you must allow interaction with the seller's browser and receive the request through the authorization server redirect. In this flow, the application requests the seller's express consent to access the data by opening a web page in which the requested areas to be accessed are made explicit.

Once access is allowed, the server generates an access code that reaches the application through a redirect. In this step, the application requests access to the authentication server by sending the obtained code and application data. Once this is done, the server grants the access token and the refresh token to the application.

To generate the authorization code, the following requirements must be met.

The PKCE (Proof Key for Code Exchange) is a security protocol used with OAuth to protect against malicious code attacks during the exchange of authorization codes for an Access token. It adds an extra layer of security by generating a verifier that is transformed into a challenge to ensure that even if the authorization code is intercepted, it is not useful without the original verifier.

In Mercado Pago, you can enable PKCE verification from the Application details screen. This allows you to send an additional secret code to be used during the authorization process.

Follow the steps below to generate the mandatory fields and configure PKCE verification.

1. The fields can be generated in various ways, either through custom development or using SDKs. Follow the necessary steps described in this official documentation to generate the required fields.
2. After generating and encrypting the fields, it will be necessary to send the respective codes to Mercado Pago. To do this, send them via query_params using the authentication URL below.

https://auth.mercadopago.com/authorization?response_type=code&client_id=$APP_ID`redirect_uri=$YOUR_URL&code_challenge=$CODE_CHALLENGE&code_challenge_method=$CODE_METHOD

• Redirect_uri: URL provided in the "Redirect URL" field of your application.
• Code_verifier: code that should be generated, following the requirements for its functionality, which include: a random sequence of characters with a length between 43 and 128 characters, including uppercase letters, lowercase letters, numbers, and some special characters. For example: 47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.
• Code_challenge: next, it is necessary to create a code_challenge from the code_verifier using one of the following transformations:
  • If it's possible to use S256, it will be necessary to use this option by transforming the code_verifier into a code_challenge through BASE64URL encoding after applying the "SHA256" function.
  • If it's not possible to use S256 for some technical reason and the server supports the Plain method, it's possible to set the code_challenge equal to the code_verifier.
• Code_challenge_method: is the method used to generate the code_challenge, as described in the above item. This field can be, for example, S256 or Plain, depending on the encoding selected in the code_challenge stage.

3. After correctly sending the codes to Mercado Pago, you will obtain the necessary authorization for get the Access token and perform PKCE verification on transactions made with OAuth.

Access token is the code used in different requests of public origin to access a protected resource that represents an authorization granted by a seller to a client application that contains scopes and a limited period of time for such access. Follow the steps below to obtain it.

1. Edit your application so that it contains your Redirect URL. See Edit Application.

2. Send the authentication URL to the seller whose account you want to link to yours with the following fields:

   Description	URL
   Authentication URL	https://auth.mercadopago.com/authorization?client_id=APP_ID&response_type=code&platform_id=mp&state=RANDOM_ID&redirect_uri=https://www.redirect-url.com

   • client_id: replace the "APP_ID" value with your application ID. Check Application ID.
   • state: replace the "RANDOM_ID" value with an identifier that is unique for each attempt and does not include sensitive information so that you can identify who the received code is from.
   • redirect_uri: add the reported URL in the Redirect URL field of your application.
   
   

3. Wait for the seller to access the URL and allow access. Upon accessing the URL, the seller will be directed to Mercado Pago and must log into their account to carry out the authorization.

4. Check your server's Redirect URL to see the authorization code returned in the code parameter.

   Description	URL
   Redirect URL	https://www.redirect-url.com?code=CODE&state=RANDOM_ID

5. Send your credentials and authorization code to the /oauth/token endpoint to receive the access token in response.