--- updatedAt: 2026-08-25T14:06:33.000Z agentTools: projectIndex: https://docs.mollie.com/llms.txt --- # Authentication (via OAuth) OAuth is the authorization layer that makes Mollie Connect work. Before your platform can act on behalf of a merchant, creating payments, managing profiles or reading account data, that merchant must explicitly grant your app permission through an OAuth authorization flow. ## OAuth as an industry standard OAuth 2.0 is the industry-standard protocol for delegated authorization and it is widely supported across different languages and frameworks. You do not need to implement it from scratch: mature libraries exist for every common stack: * Simple OAuth2 for Node.js * The PHP League's OAuth 2.0 Client for PHP * mollie/oauth2-mollie-php, Mollie's own PHP OAuth package * Authlib for Python * mollie-api-python, Mollie's Python client with built-in OAuth support For the complete OAuth reference, including authorization endpoints, token exchange, and refresh flows, see OAuth documentation. ## OAuth in Mollie Connect OAuth gives your platform a secure, auditable and revocable way to act on behalf of your merchants. Each merchant explicitly grants your app a defined set of permissions that can be inspected, scoped and revoked at any time, by either party. It allows for each connected account to be independent where token refresh is automated and there are no shared credentials to rotate or secure centrally. As your merchant base grows, the architecture stays the same across multiple organizations, allowing for easy scaling of your business. ## Registering your OAuth app You only need to create your OAuth app once in the Mollie Web App: 1. Go to **Developers → Your apps**. 2. Click **Create application** and fill in your app name and redirect URL. 3. Optionally, enable **Co-branded onboarding** and set your brand color and return URL. 4. Save the app. Your `Client ID` and `Client Secret` are now available under the app details. With your app registered, merchants authorize it by visiting an **authorization URL **you construct with your `Client ID` and the scopes you need. After they authorize, Mollie issues an `access_token` (valid for 60 minutes) and a `refresh_token` (persistent; store it encrypted).
The Onboard merchants guide covers the full authorization flow in detail. Client Links is the recommended way to onboard your merchants and create new organizations for your customers. See Onboard merchants for more details. ## Choosing the scopes Permission scopes define exactly what your app can do on behalf of a connected merchant. Make sure to request all permissions your integration needs as this can not be re-configured on the go. Adding scopes after you go-live **requires your merchants to re-authorize the app.** Think through your full scope set before launch. See the complete list of available scopes listed in Permissions. ### Scopes by integration type | Integration type | Recommended scopes | | ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | Payment processing | `payments.read` `payments.write` `refunds.read` `refunds.write` | | Subscriptions & recurring payments | `payments.read` `payments.write` `customers.read` `customers.write` `mandates.read` `mandates.write` `subscriptions.read` `subscriptions.write` | | Pay-later methods (Klarna, Billie, Riverty) | `orders.read` `orders.write` `shipments.read` `shipments.write` *(Orders API, deprecated)* | | Bookkeeping & reconciliation | `payments.read` `invoices.read` `settlements.read` `balances.read` | | ERP / OMS integrations | `orders.read` `orders.write` `shipments.read` `shipments.write` `balances.read` *(Orders API, deprecated)* | | Payment links & invoicing | `payment-links.read` `payment-links.write` | | In-person payments (terminals) | `terminals.read` `terminals.write` | | Merchant onboarding & monitoring | `organizations.read` `organizations.write` `onboarding.read` `profiles.read` `profiles.write` | **Marketplace routing is scope-free.** If you are routing payments to connected accounts (split payments, marketplace model), no additional scopes are required beyond the OAuth authorization itself. However, routing is subject to the KYB verification status of the recipient organization: Mollie will block or hold routed funds until the connected account has passed verification.