QrX Connect: Connecting Your Platform With OAuth
QrX Connect lets a merchant link their QrX channel to your system (for example a commerce app, WMS or custom shop) without copying and pasting an API key. The merchant signs in on QrX, picks a channel and clicks Allow, and your server receives that channel's API key. After that you call the same QrX Public API as any merchant integration. The QrX Shopify app uses QrX Connect.
What You Need From QrX
A client id for your integration. Each integration gets its own.
Your callback URL on your own system, HTTPS only, registered on that client. After the merchant clicks Allow, QrX redirects to that URL.
Request a client id through qrx.eu/api or by contacting QrX support.
How It Works
Open QrX login. Send the merchant to
https://portal.qr-x.app/oauth/authorizewith your client id, your callback URL, a randomstatevalue and a PKCE challenge (S256).The merchant picks a channel and clicks Allow. QrX redirects to your callback URL with a
codeand the samestate. Check that the state matches.Your server exchanges the code. Send
POST https://api.qr-x.net/api/v1/oauth/tokenas form data withgrant_type=authorization_code,client_id,code,redirect_uri(the same callback) andcode_verifier. The response contains the channel'smerchantChannelApiKey.Call the API. Exchange that key for an access token with
POST /api/v1/auth/token, exactly like a direct integration.
The authorization code can be used once. An invalid or expired code returns HTTP 400 with invalid_grant; start the flow again.
What the Connection Can Do
Only what a normal merchant API key for that one channel can do: create Payment on Delivery shipments, create labels, and read payment and tracking status. It cannot change billing or users, see other channels, or skip QrX account approval. The consumer door payment always stays on go.qr-x.app.
Security Tips
Store the received API key on your server only, encrypted, and never in a browser or app.
Do not put secrets in the callback URL, and do not pass the code to another origin.
If you suspect a key has leaked, stop using it and contact QrX support together with the merchant.
When to Contact Our Support Team
Contact QrX support at [email protected] to request or change a client id or callback URL, or when the token exchange keeps failing with a valid code.