Create an Access Token

The Galaxy Store Developer API, a set of APIs that consists of the Content Publish API, IAP APIs, and GSS Metric API, uses the OAuth 2.0 server-to-server authentication method. This means you must create an access token.

An access token allows you to use the Galaxy Store Developer API and is sent in the authorization header of every API call. It defines the scope (which APIs you can call) and can only be used from a valid service account. The access token never expires, but it can be revoked or cancelled. See Use the Access Token for more information about how to use the access token.

The following steps are required to create an access token:

1. Create a service account
2. Create a JSON Web Token
3. Request an access token

Create a service account

When you create the account, you must specify the scope of the API to be used. Only those APIs within the specified scope can be used. After you create an account, you are issued an ID and key pair of the account. The ID and private key are used to create the JSON Web Token (explained in the next section).

1. Log in to Seller Portal.

2. Click Assistance > API Service.

   

3. Click Create Service Account.

   

4. From the Create Service Account window, select the APIs that you want to use from this service account and click Create.

   Service Name	Scope ID	Description
   Publishing & ITEM	publishing	View and publish content and in-app purchase items.
   GSS	gss	View Galaxy Store Statistics (GSS) metrics.

   

5. From the Service account created window, click Download Key to save the private key to a file.

   WarningThe private key is NOT stored in Seller Portal. After you close this window, you will not be able to display it again.
   
   The private key is used to identify your app and sign your JSON Web Token. If you do not save it or lose it before creating a JWT, you must create another service account to generate a new one.
   
   Save the file in a secure place (not on a public/shared system) and treat it like a password.

   

6. After creating an account, copy the Service Account ID which is used to create the JSON Web Token (JWT).

   

You can create and use up to five service accounts.

Create a JSON Web Token

A JSON Web Token (JWT) is created from a header and registered claims which are encoded and then signed by the private key you created in the service account. You can create a JWT by providing a header and registered claims to a site that generates the token or programmatically using a JavaScript JWT library.

Header

The header consists of the encoding algorithm and token type. To use the Galaxy Store Developer APIs, you must use the RS256 encoding algorithm and JWT token type.

{
  "alg": "RS256",
  "typ": "JWT"
}

Registered claims

Registered claims are predefined attributes for which you provide values. To use the Galaxy Store Developer APIs, provide the following claims:

Create a JWT using a private site

A site, such as jwt.io, provides an interface which allows you to generate a JWT. Select RS256 as the encoding algorithm and input the payload (claim) and signatures. For example, you might enter the following for the payload:

{
  "iss": "<your-service-account-id>",
  "scopes": ["publishing", "gss"],
  "iat": 1719839022,
  "exp": 1719840222
}

Create a JWT by using JavaScript code

You can also create the JWT using the node-jsonwebtoken library. For example:

// create-jwt.js
const jsonwebtoken = require('jsonwebtoken');

const iss = <your-service-account-id>
const scopes = ['publishing', 'gss']
const iat = Math.round(new Date().getTime()/1000)
const exp = iat + 1200

try {
  const jwt = jsonwebtoken.sign({ iss, scopes, exp, iat }, privateKey, { algorithm: 'RS256' })
  console.log(jwt)
} catch (err) {
  console.error(err)
}

node create-jwt.js
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIwOWExY2JiNS02NDljLTQ5YmItOTk0Zi02ZGEyY2RlMGQzZGQiLCJzY29wZXMiOlsicHVibGlzaGluZyIsImdzcyJdLCJleHAiOjE2MTY0Njc5ODIsImlhdCI6MTYxNjQ2Nzg2Mn0.VC_GHCPSStozT1lbouG20cKn9182q1zzJQDY8Dzix_Yp2MpxnltfH0CIAPlsUi-sWciF9jZJ4LDcG5zpASEJ4KVyAx9Z7rfTiNr2wrfPWGnWk-bAAXh2QqQKESixxBqi5fEBp6NDCtbPM2H-qrv9F1sCG_eSrTiRlTiXMkoZxGb5rB2K6_pXN3qzZblRCqyBRau_XXUcTX2vR9hiogJjdLxWtzbbaycjopVPUMsx8S1aIeVuf6EeEvVZ7K2c48OyNfV6KEuYibh9AotaN4ZMQnt8RZi0kC9nCibJDL0iZZPnGWnRb692Wfxazsm0Ngt9XweO_gQBUDBoSIARPQT-zA

The JWT

The generated JWT is made up of three Base64-URL strings, separated by periods:

{Base64url encoded header}.{Base64url encoded claims}.{Base64url encoded signature}

For example, the JWT may look like this:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJjMjFmOTgyYy1jYTE2LTQ1NGMtYjc4N.aU8pej6bjO-FlXjdXKXKfwGC2PLX1NcrIPfqswQLooeASt5C

Request an access token

Finally, request an access token from the Galaxy Store authentication server using the accessToken API. If the token request specifies a scope that is beyond the scope of usage of the service account, the server returns an error.

Request

POST /auth/accessToken

The following header is required to request an access token.

Example:

curl -X POST "https://devapi.samsungapps.com/auth/accessToken" \
  -H  "content-type: application/json" \
  -H  "Authorization: Bearer <your-jwt>"

Response

Success

{
  "ok": true,
  "createdItem": {
    "accessToken": "0BjE0TJEvuOXLAzJvcAeSBHN"
  }
}

Error Codes