Authentication (via OAuth)

OAuth is the authorization layer that makes Mollie Connect work. Before your platform can act on behalf of a merchant, creating payments, managing profiles or reading account data, that merchant must explicitly grant your app permission through an OAuth authorization flow.

OAuth as an industry standard

OAuth 2.0 is the industry-standard protocol for delegated authorization and it is widely supported across different languages and frameworks. You do not need to implement it from scratch: mature libraries exist for every common stack:

• Simple OAuth2 for Node.js
• The PHP League's OAuth 2.0 Client for PHP
• mollie/oauth2-mollie-php, Mollie's own PHP OAuth package
• Authlib for Python
• mollie-api-python, Mollie's Python client with built-in OAuth support

For the complete OAuth reference, including authorization endpoints, token exchange, and refresh flows, see OAuth documentation.

OAuth in Mollie Connect

OAuth gives your platform a secure, auditable and revocable way to act on behalf of your merchants. Each merchant explicitly grants your app a defined set of permissions that can be inspected, scoped and revoked at any time, by either party.

It allows for each connected account to be independent where token refresh is automated and there are no shared credentials to rotate or secure centrally. As your merchant base grows, the architecture stays the same across multiple organizations, allowing for easy scaling of your business.

Registering your OAuth app

You only need to create your OAuth app once in the Mollie Web App:

1. Go to Developers → Your apps.
2. Click Create application and fill in your app name and redirect URL.
3. Optionally, enable Co-branded onboarding and set your brand color and return URL.
4. Save the app. Your Client ID and Client Secret are now available under the app details.

With your app registered, merchants authorize it by visiting an authorization URL you construct with your Client ID and the scopes you need. After they authorize, Mollie issues an access_token (valid for 60 minutes) and a refresh_token (persistent; store it encrypted).
The Onboard merchants guide covers the full authorization flow in detail.

Choosing the scopes

Permission scopes define exactly what your app can do on behalf of a connected merchant. Make sure to request all permissions your integration needs as this can not be re-configured on the go.

See the complete list of available scopes listed in Permissions.

Scopes by integration type