We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods.

Their APIs use OAuth 2.0 for authentication.

The problem is that OAuth 2.0 as implemented by Mercado deals with the case that the Client application and the Resource owner are different entities. So if the client application wants to view all orders made by a seller for example it will require the user to authenticate himself first on Mercado before allowing the client application to get his data.

This is a convenient flow if the client application and resource owner are different entities and the resource owner is using a browser to access the client app.

However, in my case there will be no UI. The client app that we are building will collect orders and other info from Mercado automatically with no user intervention as we own the data ourselves.


So in short I need a way to bypass the user authentication when using OAuth 2.0 without a UI.


OAuth2 defines a grant flow called client credentials grant. This allows an application to authenticate as itself and acquire an access token from the authorization server. It requires the client to register itself (get a client id) and create a client secret.

It seems that the API you're using does support this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.