GET https://my.mollie.com/oauth2/authorize

The authorize endpoint is a hosted OAuth authorization screen. It follows the OAuth 2 standard. You can use it to gather consent from another Mollie merchant for your app to access certain API resources on their behalf.

You should construct an authorization URL with the parameters below. Then, you can redirect your merchant to that URL. Typically this redirect sits behind a Connect with Mollie button.

Once redirected, the merchant will be asked to log in if they are not logged in yet. Next, the merchant will be asked to grant your app permission to access the requested resources on their account.

At the end of the flow, Mollie will redirect the merchant back to the redirect URL you specified, with a payload as described at the bottom of this page.

URL parameters

Construct the authorization URL with the parameters below.

client_id string (required)

The client ID you received when you registered your OAuth app. The ID starts with app_. For example: app_j9Pakf56Ajta6Y65AkdTtAv.

redirect_uri string

The URL the merchant is sent back to once the request has been authorized. If given, it must match the URL you set when registering your app.

state string (required)

A random string generated by your app to prevent CSRF attacks. This will be reflected in the state query parameter when the user returns to the redirect_uri after authorizing your app.

scope string (required)

A space-separated list of permissions ('scopes') your app requires. See the permissions list for more information about the available scopes.

Example: organizations.read profiles.read payments.read payments.write

response_type string (required)

The OAuth response type. We only support code responses.

Possible values: code

approval_prompt string

Can be set to force to force showing the consent screen to the merchant, even when it is not necessary. If you force an approval prompt and the user creates a new authorization, previously active authorizations will be revoked.

Possible values: auto force (default: auto)

locale string

Preset the language to be used for the login screen, if applicable. For the consent screen, the preferred language of the logged in merchant will be used and this parameter is ignored.

When this parameter is omitted, the browser language will be used instead.

Possible values: en_US nl_NL nl_BE fr_FR fr_BE de_DE es_ES it_IT

landing_page string

Specify if Mollie should show the login or the signup page, when the merchant is not logged in at Mollie.

Possible values: login signup (default: login)

Processing the result

After you redirect the merchant to Mollie, they will proceed through the authorization steps on Mollie's side.

At the end of the flow, Mollie will redirect the merchant back to the redirect URL you specified. The following parameters will be attached to the redirect URL.

code

If authorization succeeded, a code will be attached to the redirect URL. You can use this code to retrieve an access token from the Generate tokens endpoint.

state

The state string you attached to the URL will be sent back to you. Please verify it to prevent CSRF attacks.

error

If the authorization failed or your URL was invalid, the merchant will be redirected back to you with an error code.

error_description

If an error occurred, this field will also be present with a description of the error.

Using the Mollie OAuth SDK

We have SDKs available to help simplify the integration. See below example.

<?php
// composer require mollie/oauth2-mollie-php

$provider = new \Mollie\OAuth2\Client\Provider\Mollie([
    "clientId" => "app_j9Pakf56Ajta6Y65AkdTtAv",
    "clientSecret" => "S5lTvMDTjl95HGnwYmsszDtbMp8QBE2lLcRJbD7I",
    "redirectUri" => "https://example.org/oauth-redirect",
]);

$authorizationUrl = $provider->getAuthorizationUrl([
    "scope" => [
        \Mollie\OAuth2\Client\Provider\Mollie::SCOPE_ORGANIZATIONS_READ,
        \Mollie\OAuth2\Client\Provider\Mollie::SCOPE_PAYMENTS_READ,
    ],
]);