Validate an authorization request
Entry point for the Connect your GC Store flow. Validates the
client_id, redirect_uri, and requested scope and returns the
information the consent page needs to render.
Authentication: None required — this is a public endpoint. Validation errors are returned as JSON error responses, never as redirects (prevents open redirect attacks).
Rate limit: 60 requests/hour per IP address.
Query Parameters
Registered client identifier assigned when your application was approved.
Must exactly match one of your application's registered redirect URIs.
Space-separated list of permission scopes your application is requesting. Scopes are
enforced per request — a token is rejected with 403 insufficient_scope if it calls an
endpoint it wasn't granted the matching scope for. Request only what your app needs.
Available scopes: read, write, products:read, categories:read, pricing:read,
orders:read, orders:write, customers:read, customers:write, payments:read,
cart:write, cms:read, shipping:read, reviews:read, reviews:write,
gift_cards:read, messaging:read, messaging:write, returns:read, returns:write,
promotions:read, recommendations:read, search:read, store:read
A random value you generate and store. Galactic Core returns it unchanged in the callback so you can verify it and prevent CSRF attacks.
Whether to connect to the merchant's live store data or test data.
Defaults to sandbox. Pass production once your integration is
ready for live data. Merchants see this clearly on the consent screen.
sandbox, production 
