Skip to main content
GET
Validate an authorization request

Query Parameters

client_id
string
required

Registered client identifier assigned when your application was approved.

redirect_uri
string<uri>
required

Must exactly match one of your application's registered redirect URIs.

scope
string
required

Space-separated list of permission scopes your application is requesting. Scopes are enforced per request — a token is rejected with 403 insufficient_scope if it calls an endpoint it wasn't granted the matching scope for. Request only what your app needs.

Available scopes: read, write, products:read, categories:read, pricing:read, orders:read, orders:write, customers:read, customers:write, payments:read, cart:write, cms:read, shipping:read, reviews:read, reviews:write, gift_cards:read, messaging:read, messaging:write, returns:read, returns:write, promotions:read, recommendations:read, search:read, store:read

state
string
required

A random value you generate and store. Galactic Core returns it unchanged in the callback so you can verify it and prevent CSRF attacks.

environment
enum<string>
default:sandbox

Whether to connect to the merchant's live store data or test data. Defaults to sandbox. Pass production once your integration is ready for live data. Merchants see this clearly on the consent screen.

Available options:
sandbox,
production

Response

Request is valid — consent page can render

valid
boolean
required
Example:

true

client
object
required
request
object
required