OAuth API overview
The OAuth API handles merchants authentication and authorisation of external integrators. It also issues access tokens used by authorised clients to call Zettle APIs. The OAuth API implements the OAuth 2.0 protocol.

Register on the Zettle Developer Portal to create credentials for the app you
are building, and learn more about different types of integrations. See Get started for more information.
Explore the sections listed in the following to get an understanding of how to work with the OAuth API.
Using the OAuth API, your integration will have authorised access to API calls to your users' Zettle merchant data.
- Authentication: Verifies that users are valid Zettle merchants.
- Authorisation: Provides the requested access to Zettle merchant data for an integration.
The OAuth API supports the following authentication and authorisation flows:
- Code grant with PKCE
Instead of using a fixed client secret, the PKCE creates and includes a code challenge for every authorisation request. This is exchanged for access tokens and refresh tokens with the Zettle authorisation server.
- Code grant
A client secret is exchanged for access tokens and refresh tokens with the Zettle authorisation server. The refresh token is exchanged for a new access token with the server.
- Assertion grant
Using an API key in the format of a JSON web token (JWT). The API key is exchanged for access tokens with Zettle authorisation server.
Explore the OAuth API reference to learn more:
- Authorisation code grant with PKCE
- Authorisation code grant
- Authorisation assertion grant
- Get user information
- Disconnect app from user
Before building an integrating with Zettle, you need app credentials to set up the authentication and authorisation for the integration.
- For an app hosted by merchants individually, see create credentials for a self-hosted app.
- For an app hosted by you as an integrator, create credentials for a partner-hosted app.
- For an app used for taking payments, see create credentials for an SDK app.
When you have the app credentials, you can set up authentication and authorisation for the app.
- This flow should be used by all apps by default since it provides protection against several attacks.
- This flow is most often used by a partner-hosted app that is hosted by you as an integrator.
- This flow is most often used by a self-hosted app that is hosted by merchants individually.
With the OAuth API, you can also work with the following: