Authorize

Initiates the OAuth authorization flow by redirecting the user to the WorldFirst authorization page. This is a browser-side redirect rather than a standard API call — no client credentials are transmitted in the URL. After the user approves, WorldFirst redirects back to your redirectUri with an authorization code. Note: This endpoint is available to approved partners only. Contact us at techsupport@worldfirst.com — our team is ready to assist you. Request No authentication headers are required. All query parameter values must be URL-encoded. In particular, the space separating scopes is encoded as %20, and redirectUri must be percent-encoded. Response On successful authorization, WorldFirst performs a 302 redirect to redirectUri with the following query string parameters. The result is a browser-side redirect, not a signed API call.
Request Parameters
clientIdstring
required
Your application's client ID. Maximum length: 64 characters.
redirectUristring
required
The HTTPS URL to which WorldFirst redirects the user after authorization. Must match the URI registered during OAuth application. Maximum length: 2,048 characters.
scopestring
required
Space-separated list of permission scopes to request. See Scopes.
statestring
required
A random, unguessable string used to prevent CSRF attacks. Recommended minimum length: 32 characters. Maximum length: 64 characters. This value is returned in the redirect callback for verification.
referenceAccountIdstring
required
The external merchant identifier. The same WorldFirst account can authorize multiple platform stores. Maximum length: 64 characters.
Response Parameters
authCodestring
The authorization code. Valid for 10 minutes and single-use only.
statestring
The same state value from the original request, for CSRF verification.
Definition
GET /api/open/v1/oauth/authorize
Request
GET https://{domain}/api/open/v1/oauth/authorize?
  clientId=3K5YHP442YBE9W0xxxx&
  redirectUri=https://client.example.com/callback&
  scope=payouts:write%20accounts:read&
  state=a1b2c3d4e5f6&
  referenceAccountId=acct_example_001
Response
https://client.example.com/callback?authCode=SG_WDFTW3HK_2828881301697638178237324xxx&state=a1b2c3d4e5f6