Google: complete sign-in

Overview

Exchange the code Google returns after the owner signs in for the access needed to post on their behalf.

Called by the connection page after the owner grants access.

You'll need the code from Google's redirect and the store_id.

Access is saved. The owner's Google locations are available to link.

Prerequisites

• Either a bearer token in the Authorization header, or the invite hash this endpoint accepts in place of one.
• Values for the required query parameter code — see the table below.

Base URL

Endpoint

GET /api/v1/google/access-token

Authentication

• A bearer token is optional here. Send one to act as a signed-in user, or supply the documented hash instead.

• Use a bearer token (api guard).

• OR use the public connect-page pair (connect_google=1 + company_id_hash).

• OR use an invite hash.

• No token is needed for the latter two.

Rate limit

• 30 requests/min per IP (public).

Query parameters

How it works

• 200 with the token payload (web/app) or the synced location list (connect_google=1). 400 for an invalid company hash. Note: missing business.manage scope, absent access token, and Google token-endpoint errors are surfaced via errorResponse (HTTP 500) with an explanatory message.

Response

200 OK (web flow) · 200

{
  "data": {
    "google_access_token_id": 42,
    "google_access_token": "<google-access-token>",
    "account_data": []
  }
}

200 OK (connect_google=1, locations synced) · 200

{
  "data": [
    {
      "name": "Demo Store",
      "url": "https://maps.google.com/?cid=1234567890"
    }
  ]
}

400 Invalid company · 400

{
  "message": "Bad Request",
  "status": "error",
  "errors": "Invalid request!"
}

500 Scope not granted · 500

{
  "message": "You still need to grant us access to your Google Business Profile. Please be sure the check boxes are all selected.",
  "status": "error",
  "errors": []
}

Errors

Example request

curl --request GET \
  --url "https://production-api.shoutaboutus.com/api/v1/google/access-token?code=<google_oauth_code>&source=web" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json'