### Example Query String for Verification

Source: https://support.sapo.vn/oauth

This is an example of a query string containing parameters used for request verification, including store, code, timestamp, and HMAC.

```text
"store=some-store.mysapo.net&code=a94a110d86d2452eb3e2af4cfb8a3828&timestamp=1337178173&hmac=Y2YzMmJhNTAyZTc2ZWNkNTI2NDY0OTJmZGFmNWIzYjFkYmQzYzFmZjlhMGI1NDlkMGRiYzhmNzM2YWFlMTlkOQ=="
```

--------------------------------

### Handle Redirect with Authorization Code

Source: https://support.sapo.vn/oauth

After user authorization, they are redirected to this URI with an authorization code and signature. This code is temporary and must be exchanged for an access token.

```url
https://{your_domain}/some/redirect/uri?code={authorization_code}&signature=da9d83c171400a41f8db91a950508985×tamp=1409617544
```

--------------------------------

### Exchange Authorization Code for Access Token

Source: https://support.sapo.vn/oauth

After a user authorizes your application, they will be redirected to your specified `redirect_uri` with an authorization code. Use this code to obtain an access token.

```APIDOC
## Exchange Authorization Code for Access Token

### Description
After a user authorizes your application, they will be redirected to your specified `redirect_uri` with an authorization code. Use this code to obtain an access token.

### Method
POST

### Endpoint
`https://{store}.mysapo.net/admin/oauth/access_token`

### Parameters
#### Path Parameters
- **store** (string) - Required - The name of the shop.

#### Request Body
- **client_id** (string) - Required - The API Key of your application.
- **client_secret** (string) - Required - The Secret Key of your application.
- **code** (string) - Required - The authorization code received after user authorization.

### Response
#### Success Response (200)
- **access_token** (string) - The permanent API access token for the shop.
```

--------------------------------

### Request Authorization

Source: https://support.sapo.vn/oauth

Redirect users to this URL to initiate the OAuth authorization flow. Users will be prompted to grant your application access to their shop data.

```APIDOC
## Request Authorization

### Description
Redirect users to this URL to initiate the OAuth authorization flow. Users will be prompted to grant your application access to their shop data.

### Endpoint
`https://{store}.mysapo.net/admin/oauth/authorize?client_id={api_key}&scope={scopes}&redirect_uri={redirect_uri}`

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The API Key of your application.
- **scope** (string) - Required - A comma-separated list of permissions your application requests (e.g., `write_orders,read_customers`).
- **redirect_uri** (string) - Required - The URL to redirect the user to after they authorize your application. This must match the Redirect URL configured for your app.
```

--------------------------------

### Constructing the Message String for HMAC

Source: https://support.sapo.vn/oauth

Key-value pairs are joined with '=', sorted alphabetically, and then concatenated with '&' to form the message string for HMAC calculation.

```string
"code=a94a110d86d2452eb3e2af4cfb8a3828&store=some-store.mysapo.net&timestamp=1337178173"
```

--------------------------------

### Redirect User to Authorization URL

Source: https://support.sapo.vn/oauth

Use this URL to initiate the OAuth 2.0 authorization flow by redirecting the user to Sapo's authorization server. Ensure all parameters are correctly substituted.

```url
https://{store}.mysapo.net/admin/oauth/authorize?client_id={api_key}&scope={scopes}&redirect_uri={redirect_uri}
```

--------------------------------

### Parsed Query String Parameters

Source: https://support.sapo.vn/oauth

This JSON object represents the parsed key-value pairs from a query string, used for verifying requests from Sapo.

```json
{
    "store": "some-store.mysapo.net",
    "code": "a94a110d86d2452eb3e2af4cfb8a3828",
    "timestamp": "1337178173",
    "hmac": "echpNU0bdOnrrkuXuezST/t5ybfoG6SdvO/35O3gma0="
}
```

--------------------------------

### Request Access Token

Source: https://support.sapo.vn/oauth

Exchange the obtained authorization code for an access token by making a POST request to the Sapo access token endpoint. Include your client credentials and the authorization code.

```http
POST https://{store}.mysapo.net/admin/oauth/access_token

client_id=<API Key>
client_secret=<Secret Key>
code=<Authorization Code>
```

--------------------------------

### HMAC-SHA256 Validation in Ruby

Source: https://support.sapo.vn/oauth

This Ruby code snippet demonstrates how to perform HMAC-SHA256 encoding using OpenSSL and Base64, comparing the generated digest with the expected HMAC value.

```ruby
require 'openssl'
require 'base64'

digest = OpenSSL::Digest.new('sha256')
secret = "hush"
message = "store=some-store.mysapo.net&timestamp=1337178173"
digest = Base64.strict_encode64(OpenSSL::HMAC.digest(digest, secret, message))
digest == "G3jquuw8QwzywMgoWHHYq5ctguAjAY8BU4P1+ETGTPQ="
```

--------------------------------

### Access Token Response

Source: https://support.sapo.vn/oauth

The server responds with a JSON object containing the permanent API access token. Store this token securely for subsequent API requests.

```json
{
    "access_token": "f85632530bf277ec9ac6f649fc327f17"
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.