Testing with the Playground

The Playground tab of an approved app walks through the OAuth flow in your browser, so you can confirm the credentials and redirect URI before you write code. Every request it sends is real.

🚧

This Calls the Real API

Every Run sends a real request with your live client. Tokens you create here work in production. The client secret is sent to the token endpoint as part of the exchange and refresh calls, the same way your server sends it. The Developer Portal does not store that secret, and this page clears it when you leave.

Setting Up

1. Open the app and select the Playground tab (badge Live requests).
2. Paste your Client secret. If you have not generated one yet, do that under Credentials. See Managing Your Client Secret.
3. Check the Redirect URI. With one registered URI it is filled in and locked. With several, pick the one you will use.

Running the Flow

1. Send a merchant to the authorize URL. Copy the URL or click Open authorize URL. It opens in a new tab with a random state already set. Sign in as a merchant, approve the consent screen, and copy the code query parameter from the URL you land on.
2. Exchange the code for tokens. Paste the code into Authorization code and click Run token exchange. The response panel shows Success or Failed, the HTTP status, and the JSON body. On success, the access and refresh tokens are carried into the next steps.
3. Refresh the access token. The Refresh token field is filled from step 2, or paste one you already have. Click Run refresh.
4. Call the API with your access token. Click Run granted-shops to list the shops the merchant granted. That is the quickest proof the token works.

Each step's button stays disabled until it has what it needs: a code or token, and the client secret for steps 2 and 3.

🚧

No Redirect URI, No Flow

If the app has no registered redirect URI, the first step shows This app has no registered redirect URI and the authorize URL is not built. Add one under Settings. See Editing an Approved App.

Who Can Use It

Every role on the app, including read-only Members, can open the Playground. A member still needs the client secret from an admin to run steps 2 and 3.

Best Practices

• Test against a shop you own, not a customer's shop. The consent you approve is a real connection and shows up in that shop's Apps & Extensions.
• Disconnect test connections when you are done. See Merchant Consent and Disconnecting an App.