---
title: "Authenticated shopper token (Client Hosted Shopper)"
method: POST
path: "/oauth20/token (Client Hosted Shopper)"
tags: ["Token"]
---

# Authenticated shopper token (Client Hosted Shopper)

`POST /oauth20/token (Client Hosted Shopper)`

## Request

- Base URL: `https://api.digitalriver.com`
- URL: `https://api.digitalriver.com/oauth20/token (Client Hosted Shopper)`
- Auth: none declared

Use this Client Credentials Grant OAuth flow when the Digital River partner maintains the shopper login and password credentials. <br> <br> Request a full access token for the authenticated shopper by providing the shopper's external reference identifier and the client_credentials enum as the grant type. <br> <br> Security requires HTTP basic authentication (base-64 encoded), a user API key, and a password (secret key). <br> <br> <b>Important</b>&colon; Never expose or visibly display the Limited or Full Access Tokens requested by the APIs to the customer (such as plain text in a cookie). Suppose a customer has access to these tokens. They could bypass any restrictions built into the store frontend and place orders directly on our systems via publicly documented APIs.

## Request body `application/x-www-form-urlencoded`

- object
  - `dr_external_reference_id` string, required: Provide the external reference ID when requesting an authenticated shopper token for a shopper maintained by a Digital River partner.
  - `dr_limited_token` string: Provide the limited access token used to identify the anonymous shopper session when transferring the anonymous shopper session and shopping cart to a specific authenticated shopper.
  - `dr_session_token` string: Provide the shopper's session-aware token for a Digital River-hosted solution when transferring the shopper session and shopping cart to a specific authenticated shopper.
  - `grant_type` 'client_credentials' | 'password' | 'refresh_token', required: Use "client_credentials" as the grant type when the Digital River partner maintains the shopper login and password credentials. Use "refresh_token" as the grant type to continue the shopping flow for an authenticated shopper.

## Response `200`

Successful response.

- ClientCredentialToken
  - `access_token` string
  - `token_type` string
  - `expires_in` string

## Other responses

- `400`: * dr_limited_token_invalid * invalid_request
- `401`: * invalid_client * invalid_request

---

[API](https://skmtc.dev/digitalriver/apis/commerce-api-suite-shopper-apis.md) - [All operations](https://skmtc.dev/digitalriver/apis/commerce-api-suite-shopper-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/digitalriver/apis/commerce-api-suite-shopper-apis/revisions/4b69392f93b9?raw)