Use the Access Token
After you have created the access token, you must include it in the authorization header of every Galaxy Store Developer API call (which includes the Content Publish API, IAP Orders API, IAP Publish API, and GSS Metric API). The access token is valid only within the scope specified when the token was requested and it can only be used with a service account.
Authorization header parameters
The following header is required for authentication in order to use the Galaxy Store Developer API.
Attribute | Description |
---|---|
Authorization | Required. Use Bearer <your-access-token> where <your-access-token> is the access token you requested from the Galaxy Store authentication server
|
service-account-id | Required. The service account ID used to create the JWT associated with the access token (can be found in the Assistance > API Service area of Seller Portal) |
content-type | Required for POST, PUT, and PATCH requests. Must be application/json
|
The following example shows the header used with the IAP Publish API to get a list of in-app purchase items:
curl -X GET \
-H "Authorization: Bearer <your-access-token>" \
-H "service-account-id: <your-service-account-id>"
"http://devapi.samsungapps.com/iap/v6/applications/com.example.mygame/items?page=1&size=1" \
Validate an access token
Verify that the access token being used is valid.
GET /auth/checkAccessToken
Example:
curl -X GET \
-H "Authorization: Bearer <your-access-token>" \
-H "service-account-id: <your-service-account-id>" \
"https://devapi.samsungapps.com/auth/checkAccessToken"
Response
Success
{ ok: true }
See Authentication errors for information about failed requests.
Revoke an access token
When an access token is created, it does not expire and it can be used as long as the service account is valid. You can use this method to revoke or cancel the access token.
DELETE /auth/revokeAccessToken
Example:
curl -X DELETE \
-H "Authorization: Bearer <your-access-token>" \
-H "service-account-id: <your-service-account-id>" \
"https://devapi.samsungapps.com/auth/revokeAccessToken"
Response
Success
{ ok: true }
See Authentication errors for information about failed requests.
Authentication errors
The following errors may occur during authentication while using the Galaxy Store Developer API.
Error Type | Status Code | Description |
---|---|---|
AUTH_REQUIRE | 401 | The access token or service account is not valid. |
NO_PERMISSION | 403 | The service account does not have permission to use this API. |
Example Responses to Authentication Failure
Invalid Access Token:
{
"code":"AUTH_REQUIRE",
"message":"Invalid accessToken",
"from": "asgw"
}
Non-existent service account:
{
"code":"AUTH_REQUIRE",
"message":"Not found service account by serviceAccountId",
"from": "asgw"
}