ShipScript has been an eBay Community volunteer since 2003, specializing in HTML, CSS, Scripts, Photos, Active Content, Technical Solutions, and online Seller Tools.
I am certainly going to claim ignorance, but perhaps you can pull some sense out of this. I use PHP to fetch application tokens in production mode (haven't tried sandbox) and last month asked ChatGPT to give me a Python version of an OAuth application token for the Browse API. This has not been tested as Python code, although I then fed this back to Chat and requested a PHP version, which worked fine.
I have three credential files on my server, listed in the global at the top of the procedure.
Look at the funny encode() .decode() in the headers.
I'm surprised the scope is not encoded, but perhaps the "requests.post" handles that.
import os
import time
import base64
import requests
# Set up file paths
oauth_clientIdfile = os.path.join(oauth_root, "ebay_apiuser.txt")
oauth_secretIdfile = os.path.join(oauth_root, "ebay_apisecret.txt")
oauth_basictokenfile = os.path.join(oauth_root, "ebay_token_basic.txt")
def get_basic_oauth_token():
global oauth_basictokenfile
# Look at timestamp to see if it has expired
now = time.time()
duration = 7200 # Life of the token, 2 hours
margin = 60 # Remaining time before we request a new token, 1 minute
if os.path.exists(oauth_basictokenfile):
tstamp = os.path.getmtime(oauth_basictokenfile)
if tstamp + duration - now > margin: # Some time remains on token
with open(oauth_basictokenfile, 'r') as f:
return f.read().strip()
else:
return create_basic_oauth_token()
else:
return create_basic_oauth_token()
def create_basic_oauth_token():
global oauth_clientIdfile, oauth_secretIdfile, oauth_basictokenfile
url = 'https://api.ebay.com/identity/v1/oauth2/token'
clientID = open(oauth_clientIdfile, 'r').read().strip()
clientSecret = open(oauth_secretIdfile, 'r').read().strip()
headers = {
'Content-Type': 'application/x-www-form-urlencoded',
'Authorization': 'Basic ' + base64.b64encode((clientID + ':' + clientSecret).encode()).decode()
}
body = {
'grant_type': 'client_credentials',
'scope': 'https://api.ebay.com/oauth/api_scope'
}
response = requests.post(url, headers=headers, data=body)
if response.ok:
token = response.json()
if 'access_token' in token:
with open(oauth_basictokenfile, 'w') as f:
f.write(token['access_token'])
return token['access_token']
else:
response.raise_for_status()
# Example usage:
# token = get_basic_oauth_token()
# print(token)
You may also find some Python code examples (snippets actually) on other threads here, and in some of eBay's API pages.
I'll definitely be interested in what you can come up with. There are many who would like a token script, and Python appears to be an ever more popular language.
The PHP source code from which ChatGPT derived the Python version can be found here, so if something doesn't work in Python, you can at least see the working PHP version:
The PHP curl prep is split into two formats to show two different mechanisms - there is no requirement for doing it that way.
Additionally, my PHP OAuth code queries the age of the token file. eBay recommends actually testing whether the token has expired and then minting a new token if that is the case.
@fillersfulfillment Wonderful!!
I would recommend that you hurry and edit (down arrow at top right of post) to use the </> code tool so that the indents show. Use the ellipsis to open more on the toolbar and then select the </> tool. If too late to edit, then perhaps you can repost the code.
Client_credentials (for public data) is the wrong type of OAuth token for the Trading API (private data) .
https://developer.ebay.com/api-docs/static/oauth-client-credentials-grant.html
While Auth-n-auth supported a single 18-month token for private data, the Oauth process for private data is three parts:
- The 5-minute authorization from the account owner.
- Trading that in for a 2-hour access token and an 18 month refresh token.
- And then updating the 2-hour access token with the refresh token as needed.
https://developer.ebay.com/api-docs/static/oauth-authorization-code-grant.html
If working with private data, start out with the authorization process.
https://developer.ebay.com/api-docs/static/oauth-authorization-code-grant.html
This asks the user to log in and grant permission. The user's acceptance redirects to the URL you have provided (either on the developer screen or programmatically) and includes a query string with the 5-minute authorization code.
https://developer.ebay.com/api-docs/static/oauth-consent-request.html
That authorization code is then fed into a token request, which returns the access token and the refresh token.
https://developer.ebay.com/api-docs/static/oauth-auth-code-grant-request.html
If you are doing this for your own account, you can simply request the 5-minute authorization on the developer screen and then hurriedly feed it into the token request. Pick up the 18-month refresh token and use that for the next 18 months to request a two-hour access token.
https://developer.ebay.com/api-docs/static/oauth-refresh-token-request.html
Minting the 2-hour token should be quite similar to what you are doing to mint a token for client_credentials (which accesses public data).
You will notice that you must pass a scope list when getting user authorization. However, it is not necessary to pass the scope list when minting a token unless you want to use only a subset of what the user authorized. (Or at least, that is my understanding from reading the last paragraph on the scopes page.)
https://developer.ebay.com/api-docs/static/oauth-scopes.html
