Complete Temu Authorization (OAuth Callback)
GET/integrations/temu/callback
Called by the merchant's browser, not by an integrator (note: no /api prefix). This is the redirect URI registered with Temu: after the merchant authorizes SKU.io in Temu Seller Central (opened from the authorization_url returned by Initialize OAuth or Get Authorization URL), Temu redirects the browser here. No bearer token.
Query parameters sent by Temu
code— authorization code.state— the tenant-prefixed value SKU.io issued (<tenant id>_<suffix>); the prefix identifies the workspace.callback_host— the Temu API gateway for the merchant's region. Only Temu's own gateways are accepted (openapi-b-us.temu.com,openapi-b-eu.temu.com,openapi-b-global.temu.com, or the configured sandbox host); anything else fails withinvalid_callback_host. It becomes the connection's API base URL.
Behaviour: a new-integration flow does not exchange the code here: the browser is sent back with code, state and callback_host, and the app then calls Complete OAuth to create the integration. A reconnect flow (started for an existing connection) exchanges the code here and updates that connection directly (isReconnect=true); if that connection was deleted meanwhile the result is connection_not_found.
Response: always a 302 redirect to the workspace's own host at /v2/integrations/temu/callback with success and, when set, state, code, callback_host, message, error, errorMessage and isReconnect. Error codes: missing_parameters (no code or state), invalid_callback_host, connection_not_found, callback_failed.
Authentication: none (public redirect target, secured by state).
Request
Responses
- 302
- 401
- 403
- 429
Found
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.