Skip to main content

Complete PayPal Authorization (OAuth Callback)

GET 
/api/paypal/oauth/callback

Called by the merchant's browser, not by an integrator. This is the return URL PayPal redirects the merchant to after they finish the Connect with PayPal sign-up started by Start PayPal Authorization. It needs no bearer token; it is authenticated by the single-use state SKU.io issued, and the merchant id is confirmed with PayPal before anything is saved.

Not yet available to API tokens

This endpoint currently requires session authentication; Personal Access Token scope support is in progress.

Query parameters sent by PayPal

  • state (required) — the value SKU.io put on the return URL. Its prefix names the tenant (so the request can land on the shared domain), its suffix is the referral's tracking id. Expired, unknown or already-used states fail.
  • merchantIdInPayPal — the merchant's PayPal account id. SKU.io looks up which merchant finished this referral (by tracking id) and refuses the connection if PayPal reports a different merchant or can't confirm it.
  • permissionsGranted — true when the merchant granted SKU.io the requested permissions.
  • merchantId, accountStatus, consentStatus, isEmailConfirmed, productIntentId — also sent by PayPal; accepted but informational (status is re-read from PayPal).

Response: always a 302 redirect to the tenant's own workspace at /v2/integrations/paypal/callback, which notifies the window that opened the popup and closes itself:

  • success: ?success=1&instance_id=12
  • failure: ?success=0&error_message=... (missing merchant id, invalid or expired state, merchant could not be confirmed, or the PayPal account is already connected to another integration).

A missing state returns 422.

Authentication: none (public redirect target, secured by the single-use state).

Request​

Responses​

Found

Response Headers
    Location