授權第三方應用程式存取 Merchant Center 帳戶
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
本指南將說明如何使用 OAuth 2.0 要求存取其他方的 Merchant Center 帳戶。如果您是第三方供應商，請使用這個工作流程，讓應用程式要求存取客戶的 Merchant Center 帳戶。
如果你正在開發內部應用程式，且只需要存取 Merchant Center 帳戶，請參閱「存取帳戶」相關說明。
要求驗證應用程式
存取 Merchant API 的應用程式必須通過 OAuth 驗證審查程序。未經驗證的應用程式會收到警告，且功能受到限制。
應用程式是指在 Google Cloud 中具有專屬 OAuth 2.0 用戶端 ID 的任何項目。
驗證程序通常需要 3 至 5 個工作天。如要進一步瞭解相關資訊，並提交驗證要求，請參閱「應用程式驗證」。
這項政策適用於所有應用程式。建議所有應用程式盡早完成驗證程序，以免業務中斷。
取得 OAuth 範圍
設定漸進式授權，避免範圍選取問題。
如果您要求多個 OAuth 範圍，則系統會在應用程式的同意畫面中預設取消選取所有範圍。當應用程式向使用者顯示同意畫面時，使用者必須手動選取每個範圍，才能授予存取權。
如要使用 Merchant API，您的應用程式必須在 OAuth 同意畫面上要求下列範圍：
https://www.googleapis.com/auth/content
檢查 OAuth 要求的回應，確認應用程式已收到此權限範圍。
詳情請參閱「OAuth 2.0 政策」。
授權要求
您的應用程式傳送至 Merchant API 的每項要求都必須包含授權權杖。這個權杖也可讓 Google 識別您的應用程式。
關於授權通訊協定
您的應用程式必須使用 OAuth 2.0 對要求進行授權，系統不支援其他授權通訊協定。如果您的應用程式採用使用 Google 帳戶登入功能，系統會為您處理部分授權事項。
使用 OAuth 2.0 對要求進行授權
所有傳送至 Merchant API 的要求都必須由經過驗證的使用者進行授權。
OAuth 2.0 授權程序 (或「流程」) 的細節會根據您編寫的應用程式類型而有所不同。下列一般程序適用於所有應用程式類型：
- 建立應用程式後，請透過 Google API 控制台註冊應用程式。接著 Google 會向您提供稍後需要的資訊，例如用戶端 ID 和用戶端密碼。
- 在 Google API 控制台中啟用 Merchant API。(如果 API 控制台裡沒有列出該 API，則可略過這個步驟)。
- 當應用程式需要存取使用者資料時，會向 Google 要求特定的存取範圍。
- Google 會向使用者顯示同意畫面，請對方授權您的應用程式要求部分資料。
- 如果使用者同意，Google 即會授予短期存取權杖給您的應用程式。
- 您的應用程式向使用者要求資料，並且在要求中附上存取權杖。
- 如果 Google 判定您的要求與權杖有效，便會傳回您要求的資料。
部分流程包含額外步驟，例如使用「更新權杖」來取得新的存取權杖。如要進一步瞭解各類應用程式的流程，請參閱 Google 的 OAuth 2.0 說明文件。
以下列出 Merchant API 的 OAuth 2.0 範圍相關資訊：
| 範圍 |
意義 |
https://www.googleapis.com/auth/content |
讀取/寫入權限。 |
如要透過 OAuth 2.0 要求存取權，您的應用程式需要範圍資訊，以及 Google 在您註冊應用程式時提供的資訊 (例如用戶端 ID 和用戶端密碼)。
以下是可用於授權的範例。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-08-29 (世界標準時間)。
[null,null,["上次更新時間：2025-08-29 (世界標準時間)。"],[[["\u003cp\u003eThis guide explains how third-party providers can use OAuth 2.0 to request access to their clients' merchant accounts through their apps.\u003c/p\u003e\n"],["\u003cp\u003eApps accessing the Merchant API need to be verified to avoid limitations, a process that usually takes 3-5 business days.\u003c/p\u003e\n"],["\u003cp\u003eIncremental authorization is recommended during setup to prevent scope selection issues and ensure the app receives necessary permissions.\u003c/p\u003e\n"],["\u003cp\u003eAll Merchant API requests must be authorized using OAuth 2.0 with a valid access token, obtainable through the described authorization flow.\u003c/p\u003e\n"],["\u003cp\u003eDevelopers can find resources such as OAuth 2.0 scope information and authorization samples within the guide for implementation.\u003c/p\u003e\n"]]],["Third-party providers use OAuth 2.0 to access clients' merchant accounts, requiring app verification via Google Cloud (3-5 days). Apps must request the `https://www.googleapis.com/auth/content` scope on the consent screen, which users must manually select. Each Merchant API request needs an authorization token. The OAuth process involves registering the app, requesting a scope, user consent via a screen, receiving an access token, and attaching it to data requests.\n"],null,["# Authorize third-party app access to Merchant Center account\n\nThis guide explains how to use [OAuth 2.0](/identity/protocols/OAuth2) to\nrequest access to other parties' merchant center accounts. If you're a\nthird-party provider, use this workflow to let your app request access to your\nclients' Merchant Center accounts.\n\nIf you're developing an in-house app that needs access to only your Merchant\nCenter account, see [access your account](/merchant/api/guides/authorization/access-your-account)\ninstead.\n\nRequest app verification\n------------------------\n\nApps that access the Merchant API must go through the OAuth verification review\nprocess. Unverified apps will receive [warnings](//support.google.com/cloud/answer/7454865)\nand have [limited functionality](//support.google.com/cloud/answer/7454865#unverified-app-user-cap).\n\nAn app is anything with a unique OAuth 2.0 Client ID in Google Cloud.\n\nThe verification process typically takes 3-5 business days. To learn more and to\nsubmit a request for verification, see [verification for apps](//support.google.com/cloud/answer/7454865#verification).\n\nThis policy applies to all apps. We recommend all apps undergo the verification\nprocess as early as possible to avoid business interruptions.\n\nGet OAuth scopes\n----------------\n\nSet up [incremental authorization](/identity/protocols/oauth2/web-server#incrementalAuth)\nto avoid issues with scope selection.\n\nAll [OAuth scopes](/identity/protocols/oauth2/scopes) are\nunselected by default in the consent screen for your app if you request more\nthan one. When your app presents the consent screen to a user, the user has to\nmanually select each scope to authorize access.\n\nTo use Merchant API, your app must request the following scope on the OAuth\nconsent screen: \n\n https://www.googleapis.com/auth/content\n\nCheck the response from an OAuth request to verify that your app received this\nscope.\n\nSee [OAuth 2.0 policies](/identity/protocols/oauth2/policies#unbundled-consent)\nfor more details.\n\nAuthorize requests\n------------------\n\nEvery request your application sends to the Merchant API must include an authorization token. The token also identifies your application to Google.\n\n### About authorization protocols\n\nYour application must use [OAuth 2.0](https://developers.google.com/identity/protocols/OAuth2) to authorize requests. No other authorization protocols are supported. If your application uses [Sign In With Google](https://developers.google.com/identity/gsi/web), some aspects of authorization are handled for you.\n\n### Authorizing requests with OAuth 2.0\n\nAll requests to the Merchant API must be authorized by an authenticated user.\n\nThe details of the authorization process, or \"flow,\" for OAuth 2.0 vary somewhat depending on what kind of application you're writing. The following general process applies to all application types:\n\n1. When you create your application, you register it using the [Google API Console](https://console.cloud.google.com/). Google then provides information you'll need later, such as a client ID and a client secret.\n2. Activate the Merchant API in the Google API Console. (If the API isn't listed in the API Console, then skip this step.)\n3. When your application needs access to user data, it asks Google for a particular **scope** of access.\n4. Google displays a **consent screen** to the user, asking them to authorize your application to request some of their data.\n5. If the user approves, then Google gives your application a short-lived **access token**.\n6. Your application requests user data, attaching the access token to the request.\n7. If Google determines that your request and the token are valid, it returns the requested data.\n\nSome flows include additional steps, such as using **refresh tokens** to acquire new access tokens. For detailed information about flows for various types of applications, see Google's [OAuth 2.0 documentation](https://developers.google.com/identity/protocols/OAuth2).\n\nHere's the OAuth 2.0 scope information for the Merchant API:\n\n| Scope | Meaning |\n|-------------------------------------------|--------------------|\n| `https://www.googleapis.com/auth/content` | Read/write access. |\n\nTo request access using OAuth 2.0, your application needs the scope information, as well as\ninformation that Google supplies when you register your application (such as the client ID and the\nclient secret).\n\nHere's a [sample](/merchant/api/samples/authorization) you can use for\nauthorization."]]
