[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-29 (世界標準時間)。"],[[["\u003cp\u003eThis guide explains how third-party providers can use OAuth 2.0 to request access to their clients' merchant accounts through their apps.\u003c/p\u003e\n"],["\u003cp\u003eApps accessing the Merchant API need to be verified to avoid limitations, a process that usually takes 3-5 business days.\u003c/p\u003e\n"],["\u003cp\u003eIncremental authorization is recommended during setup to prevent scope selection issues and ensure the app receives necessary permissions.\u003c/p\u003e\n"],["\u003cp\u003eAll Merchant API requests must be authorized using OAuth 2.0 with a valid access token, obtainable through the described authorization flow.\u003c/p\u003e\n"],["\u003cp\u003eDevelopers can find resources such as OAuth 2.0 scope information and authorization samples within the guide for implementation.\u003c/p\u003e\n"]]],["Third-party providers use OAuth 2.0 to access clients' merchant accounts, requiring app verification via Google Cloud (3-5 days). Apps must request the `https://www.googleapis.com/auth/content` scope on the consent screen, which users must manually select. Each Merchant API request needs an authorization token. The OAuth process involves registering the app, requesting a scope, user consent via a screen, receiving an access token, and attaching it to data requests.\n"],null,["# Authorize third-party app access to Merchant Center account\n\nThis guide explains how to use [OAuth 2.0](/identity/protocols/OAuth2) to\nrequest access to other parties' merchant center accounts. If you're a\nthird-party provider, use this workflow to let your app request access to your\nclients' Merchant Center accounts.\n\nIf you're developing an in-house app that needs access to only your Merchant\nCenter account, see [access your account](/merchant/api/guides/authorization/access-your-account)\ninstead.\n\nRequest app verification\n------------------------\n\nApps that access the Merchant API must go through the OAuth verification review\nprocess. Unverified apps will receive [warnings](//support.google.com/cloud/answer/7454865)\nand have [limited functionality](//support.google.com/cloud/answer/7454865#unverified-app-user-cap).\n\nAn app is anything with a unique OAuth 2.0 Client ID in Google Cloud.\n\nThe verification process typically takes 3-5 business days. To learn more and to\nsubmit a request for verification, see [verification for apps](//support.google.com/cloud/answer/7454865#verification).\n\nThis policy applies to all apps. We recommend all apps undergo the verification\nprocess as early as possible to avoid business interruptions.\n\nGet OAuth scopes\n----------------\n\nSet up [incremental authorization](/identity/protocols/oauth2/web-server#incrementalAuth)\nto avoid issues with scope selection.\n\nAll [OAuth scopes](/identity/protocols/oauth2/scopes) are\nunselected by default in the consent screen for your app if you request more\nthan one. When your app presents the consent screen to a user, the user has to\nmanually select each scope to authorize access.\n\nTo use Merchant API, your app must request the following scope on the OAuth\nconsent screen: \n\n https://www.googleapis.com/auth/content\n\nCheck the response from an OAuth request to verify that your app received this\nscope.\n\nSee [OAuth 2.0 policies](/identity/protocols/oauth2/policies#unbundled-consent)\nfor more details.\n\nAuthorize requests\n------------------\n\nEvery request your application sends to the Merchant API must include an authorization token. The token also identifies your application to Google.\n\n### About authorization protocols\n\nYour application must use [OAuth 2.0](https://developers.google.com/identity/protocols/OAuth2) to authorize requests. No other authorization protocols are supported. If your application uses [Sign In With Google](https://developers.google.com/identity/gsi/web), some aspects of authorization are handled for you.\n\n### Authorizing requests with OAuth 2.0\n\nAll requests to the Merchant API must be authorized by an authenticated user.\n\nThe details of the authorization process, or \"flow,\" for OAuth 2.0 vary somewhat depending on what kind of application you're writing. The following general process applies to all application types:\n\n1. When you create your application, you register it using the [Google API Console](https://console.cloud.google.com/). Google then provides information you'll need later, such as a client ID and a client secret.\n2. Activate the Merchant API in the Google API Console. (If the API isn't listed in the API Console, then skip this step.)\n3. When your application needs access to user data, it asks Google for a particular **scope** of access.\n4. Google displays a **consent screen** to the user, asking them to authorize your application to request some of their data.\n5. If the user approves, then Google gives your application a short-lived **access token**.\n6. Your application requests user data, attaching the access token to the request.\n7. If Google determines that your request and the token are valid, it returns the requested data.\n\nSome flows include additional steps, such as using **refresh tokens** to acquire new access tokens. For detailed information about flows for various types of applications, see Google's [OAuth 2.0 documentation](https://developers.google.com/identity/protocols/OAuth2).\n\nHere's the OAuth 2.0 scope information for the Merchant API:\n\n| Scope | Meaning |\n|-------------------------------------------|--------------------|\n| `https://www.googleapis.com/auth/content` | Read/write access. |\n\nTo request access using OAuth 2.0, your application needs the scope information, as well as\ninformation that Google supplies when you register your application (such as the client ID and the\nclient secret).\n\nHere's a [sample](/merchant/api/samples/authorization) you can use for\nauthorization."]]
