Authorization Code Flow for Server-side Apps¶

Step 1: Sign in and get credentials¶

First, get a Consumer Key and Consumer Secret by signing in at developer.yahoo.com and creating a project. You will use these credentials for later calls in the OAuth 2.0 flow.

To create an app project, Yahoo needs information about your application including:

• name

• type

• home page URL

• scopes (permissions for specific services)

• application domain

Step 2: Get an authorization URL and authorize access¶

Use the Consumer Key we provide as the client_id to request a redirect URL. Also include the redirect_url so that Yahoo knows where to redirect users after they authorize access to their data.

URL: https://api.login.yahoo.com/oauth2/request_auth

Method: GET, POST

Sample URL

https://api.login.yahoo.com/oauth2/request_auth?client_id=dj0yJmk9ak5IZ2x5WmNsaHp6JmQ9WVdrOVNqQkJUMnRYTjJrbWNHbzlNQS0tJnM9Y29uc3VtZXJzZWNyZXQmeD1hYQ--&redirect_uri=oob&response_type=code&language=en-us

Step 3: User redirected for access authorization¶

A successful response to request_auth initiates a 302 redirect to Yahoo where the user can authorize access.

Step 4: Exchange authorization code for access token¶

Once the user authorizes access, the user is redirected back to the redirect_uri you originally specified. A authorization code is appended to the redirect_uri, shown below as code=abcdef:

https://www.example.com/callback?code=abcdef&state=XYZ

Your client needs to extract the authorization code and exchange it for an access token using a call to the /get_token endpoint. The response also contains the refresh token, which persists even when the user changes passwords. The authorization server may issue a new refresh token, in which case the client must discard the old refresh token and replace it with the new refresh token. The authorization server will revoke the old refresh token after issuing a new refresh token to the client. The refresh token can also be invalidated if the user revokes access through Yahoo account settings.

URL: https://api.login.yahoo.com/oauth2/get_token

Method: POST

Sample Request Header

Authorization: Basic ZGoweUptazlhazVJWjJ4NVdtTnNhSHA2Sm1ROVdWZHJPVk5xUWtKVU1uUllUakpyYldOSGJ6bE5RUzB0Sm5NOVkyOXVjM1Z0WlhKelpXTnlaWFFtZUQxaFlRLS06NmYzYjI5NjllYzUwOTkxNDM4MDdiNDU4ZTU5MTc5MzFmYmEzMWUwOA==
Content-Type: application/x-www-form-urlencoded

Sample Request Body

grant_type=authorization_code&redirect_uri=https%3A%2F%2Fwww.example.com&code=abcdef

Sample Response

{
   "access_token":"Jzxbkqqcvjqik2IMxGFEE1cuaos--",
   "token_type":"bearer",
   "expires_in":3600,
   "refresh_token":"AOiRUlJn_qOmByVGTmUpwcMKW3XDcipToOoHx2wRoyLgJC_RFlA-",
   "xoauth_yahoo_guid":"JT4FACLQZI2OCE"
}

Step 5: Exchange refresh token for new access token¶

After the access token expires, you can use the refresh token, which has a long lifetime, to get a new access token.

URL: https://api.login.yahoo.com/oauth2/get_token

Method: POST

Sample Request Header

Authorization: Basic ZGoweUptazlhazVJWjJ4NVdtTnNhSHA2Sm1ROVdWZHJPVk5xUWtKVU1uUllUakpyYldOSGJ6bE5RUzB0Sm5NOVkyOXVjM1Z0WlhKelpXTnlaWFFtZUQxaFlRLS06NmYzYjI5NjllYzUwOTkxNDM4MDdiNDU4ZTU5MTc5MzFmYmEzMWUwOA==
Content-Type: application/x-www-form-urlencoded

Sample Request Body

grant_type=refresh_token&redirect_uri=https%3A%2F%2Fwww.example.com&refresh_token=a_qOmByVGTm

Sample Response

{
   "access_token":"Jzxbkqqcvjqik2IMxGFEE1cuaos--",
   "token_type":"bearer",
   "expires_in":3600,
   "refresh_token":"AOiRUlJn_qOmByVGTmUpwcMKW3XDcipToOoHx2wRoyLgJC_RFlA-",
   "xoauth_yahoo_guid":"JT4FACLQZI2OCE"
}