GC Connect

Approve the authorization (merchant consent)

Called by the Galactic Core consent page after the merchant clicks Authorize. Provisions a key pair for the selected store, records the connection, and returns the redirect URL the browser should follow to complete the flow.

An agency-scoped application can be authorized only by a store that belongs to that agency; a store outside the agency receives 403.

Authentication: The merchant’s active Galactic Core session JWT in the Authorization: Bearer header. This is not an API key — it is the session token issued by the GC login flow.

Rate limit: 20 requests/hour per IP address, and 20 approvals per hour per merchant.

This endpoint is called by the hosted consent page — you do not call it directly from your integration.

POST

connect

authorize

Approve the authorization (merchant consent)

curl --request POST \
  --url https://api.tybritelabs.com/v1/connect/authorize \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "client_id": "fantastic-storefront",
  "redirect_uri": "https://yourapp.com/callback",
  "scope": "read orders:read",
  "state": "a8f3d2e1c9b7",
  "environment": "sandbox",
  "store_id": "550e8400-e29b-41d4-a716-446655440000"
}
'

import requests

url = "https://api.tybritelabs.com/v1/connect/authorize"

payload = {
    "client_id": "fantastic-storefront",
    "redirect_uri": "https://yourapp.com/callback",
    "scope": "read orders:read",
    "state": "a8f3d2e1c9b7",
    "environment": "sandbox",
    "store_id": "550e8400-e29b-41d4-a716-446655440000"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    client_id: 'fantastic-storefront',
    redirect_uri: 'https://yourapp.com/callback',
    scope: 'read orders:read',
    state: 'a8f3d2e1c9b7',
    environment: 'sandbox',
    store_id: '550e8400-e29b-41d4-a716-446655440000'
  })
};

fetch('https://api.tybritelabs.com/v1/connect/authorize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/connect/authorize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'client_id' => 'fantastic-storefront',
    'redirect_uri' => 'https://yourapp.com/callback',
    'scope' => 'read orders:read',
    'state' => 'a8f3d2e1c9b7',
    'environment' => 'sandbox',
    'store_id' => '550e8400-e29b-41d4-a716-446655440000'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/connect/authorize"

	payload := strings.NewReader("{\n  \"client_id\": \"fantastic-storefront\",\n  \"redirect_uri\": \"https://yourapp.com/callback\",\n  \"scope\": \"read orders:read\",\n  \"state\": \"a8f3d2e1c9b7\",\n  \"environment\": \"sandbox\",\n  \"store_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/connect/authorize")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"client_id\": \"fantastic-storefront\",\n  \"redirect_uri\": \"https://yourapp.com/callback\",\n  \"scope\": \"read orders:read\",\n  \"state\": \"a8f3d2e1c9b7\",\n  \"environment\": \"sandbox\",\n  \"store_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/connect/authorize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"client_id\": \"fantastic-storefront\",\n  \"redirect_uri\": \"https://yourapp.com/callback\",\n  \"scope\": \"read orders:read\",\n  \"state\": \"a8f3d2e1c9b7\",\n  \"environment\": \"sandbox\",\n  \"store_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}"

response = http.request(request)
puts response.read_body

{
  "redirect_to": "https://yourapp.com/callback?code=abc123def456&state=a8f3d2e1c9b7"
}

{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request parameters",
    "details": "The 'email' field is required"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "This operation requires a secret key. Publishable keys cover catalogue reads and the actions a shopper takes for themselves."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Resource not found"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key. Please slow down and try again shortly.",
    "remaining": 0,
    "reset": 1706198400
  }
}

{
  "error": {
    "code": "server_error",
    "message": "An unexpected error occurred"
  }
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Body

application/json

client_id

string

required

Registered client identifier.

Example:

"fantastic-storefront"

redirect_uri

string<uri>

required

Must match the URI from the original GET request.

Example:

"https://yourapp.com/callback"

scope

string

required

Space-separated list of scopes from the original GET request.

Example:

"read orders:read"

state

string

required

CSRF token from the original GET request.

Example:

"a8f3d2e1c9b7"

environment

enum<string>

required

Environment for the provisioned key pair.

Available options:

sandbox,

production

Example:

"sandbox"

store_id

string<uuid>

required

UUID of the store the merchant is authorizing access to.

Example:

"550e8400-e29b-41d4-a716-446655440000"

Response

Authorization approved — redirect the browser to redirect_to

redirect_to

string<uri>

required

The URL to redirect the merchant's browser to. Contains a short-lived one-time code and the original state value.

Example:

"https://yourapp.com/callback?code=abc123def456&state=a8f3d2e1c9b7"

Approve the authorization (merchant consent)

curl --request POST \
  --url https://api.tybritelabs.com/v1/connect/authorize \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "client_id": "fantastic-storefront",
  "redirect_uri": "https://yourapp.com/callback",
  "scope": "read orders:read",
  "state": "a8f3d2e1c9b7",
  "environment": "sandbox",
  "store_id": "550e8400-e29b-41d4-a716-446655440000"
}
'

import requests

url = "https://api.tybritelabs.com/v1/connect/authorize"

payload = {
    "client_id": "fantastic-storefront",
    "redirect_uri": "https://yourapp.com/callback",
    "scope": "read orders:read",
    "state": "a8f3d2e1c9b7",
    "environment": "sandbox",
    "store_id": "550e8400-e29b-41d4-a716-446655440000"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    client_id: 'fantastic-storefront',
    redirect_uri: 'https://yourapp.com/callback',
    scope: 'read orders:read',
    state: 'a8f3d2e1c9b7',
    environment: 'sandbox',
    store_id: '550e8400-e29b-41d4-a716-446655440000'
  })
};

fetch('https://api.tybritelabs.com/v1/connect/authorize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/connect/authorize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'client_id' => 'fantastic-storefront',
    'redirect_uri' => 'https://yourapp.com/callback',
    'scope' => 'read orders:read',
    'state' => 'a8f3d2e1c9b7',
    'environment' => 'sandbox',
    'store_id' => '550e8400-e29b-41d4-a716-446655440000'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/connect/authorize"

	payload := strings.NewReader("{\n  \"client_id\": \"fantastic-storefront\",\n  \"redirect_uri\": \"https://yourapp.com/callback\",\n  \"scope\": \"read orders:read\",\n  \"state\": \"a8f3d2e1c9b7\",\n  \"environment\": \"sandbox\",\n  \"store_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/connect/authorize")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"client_id\": \"fantastic-storefront\",\n  \"redirect_uri\": \"https://yourapp.com/callback\",\n  \"scope\": \"read orders:read\",\n  \"state\": \"a8f3d2e1c9b7\",\n  \"environment\": \"sandbox\",\n  \"store_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/connect/authorize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"client_id\": \"fantastic-storefront\",\n  \"redirect_uri\": \"https://yourapp.com/callback\",\n  \"scope\": \"read orders:read\",\n  \"state\": \"a8f3d2e1c9b7\",\n  \"environment\": \"sandbox\",\n  \"store_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}"

response = http.request(request)
puts response.read_body

{
  "redirect_to": "https://yourapp.com/callback?code=abc123def456&state=a8f3d2e1c9b7"
}

{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request parameters",
    "details": "The 'email' field is required"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "This operation requires a secret key. Publishable keys cover catalogue reads and the actions a shopper takes for themselves."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Resource not found"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key. Please slow down and try again shortly.",
    "remaining": 0,
    "reset": 1706198400
  }
}

{
  "error": {
    "code": "server_error",
    "message": "An unexpected error occurred"
  }
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Approve the authorization (merchant consent)

Authorizations

Body

Response