{
  "grant_type": "authorization_code",
  "code": "<authorization code from Step 3>",
  "client_id": "<your clientId>",
  "client_secret": "<your clientSecret>",
  "redirect_uri": "<your redirect uri>"
}

{
  "access_token": "<access_token>",
  "id_token": "<id_token>",         // Only included if you requested the 'openid' scope
  "refresh_token": "<refresh_token>", // Only included if you requested the 'offline_access' scope
  "scope": "<granted scopes>",
  "expires_in": 86400,              // Token validity in seconds (24 hours)
  "token_type": "Bearer"
}

{
  "grant_type": "refresh_token",
  "refresh_token": "<refresh_token>",
  "client_id": "<your clientId>",
  "client_secret": "<your clientSecret>"
}

pip install auth0-python requests

import time
import requests
from auth0.authentication import GetToken
from urllib.parse import urlencode

class Pax8AuthClient:
    # Pax8 OAuth2 configuration
    DOMAIN = "login.pax8.com"
    CLIENT_ID = "YOUR_CLIENT_ID"
    CLIENT_SECRET = "YOUR_CLIENT_SECRET"
    REDIRECT_URI = "https://your-app.com/callback"
    AUDIENCE = "https://api.pax8.com"
    SCOPE = "Manage:Pax8Data offline_access"
    
    def __init__(self):
        self.access_token = None
        self.refresh_token = None
        self.expires_at = 0
        self.auth0_client = GetToken(self.DOMAIN)
    
    def get_authorization_url(self):
        """Generate the authorization URL to redirect the user to"""
        # Build the authorization URL with all required parameters
        # The Auth0 SDK will handle state parameter automatically
        params = {
            'response_type': 'code',
            'client_id': self.CLIENT_ID,
            'redirect_uri': self.REDIRECT_URI,
            'scope': self.SCOPE,
            'audience': self.AUDIENCE
        }
        
        query_string = urlencode(params)
        authorization_url = f'https://{self.DOMAIN}/authorize?{query_string}'
        
        return authorization_url
    
    def exchange_code(self, code):
        """Exchange the authorization code for tokens"""
        # Exchange the code for tokens using Auth0 SDK
        token_data = self.auth0_client.authorization_code(
            client_id=self.CLIENT_ID,
            client_secret=self.CLIENT_SECRET,
            code=code,
            redirect_uri=self.REDIRECT_URI
        )
        
        self.access_token = token_data.get('access_token')
        self.refresh_token = token_data.get('refresh_token')
        self.expires_at = time.time() + token_data.get('expires_in', 86400)
        
        return token_data
    
    def refresh_token_if_needed(self):
        """Refresh the access token if it's expired"""
        if not self.refresh_token:
            raise ValueError("No refresh token available")
        
        if time.time() >= self.expires_at:
            token_data = self.auth0_client.refresh_token(
                client_id=self.CLIENT_ID,
                client_secret=self.CLIENT_SECRET,
                refresh_token=self.refresh_token
            )
            
            self.access_token = token_data.get('access_token')
            self.expires_at = time.time() + token_data.get('expires_in', 86400)
            
            # The refresh token might be rotated, so update it if a new one is provided
            if 'refresh_token' in token_data:
                self.refresh_token = token_data.get('refresh_token')
    
    def call_api(self, endpoint):
        """Make a request to the Pax8 API (placeholder)"""
        self.refresh_token_if_needed()
        
        # In a real implementation, you would make an actual API call here
        # This is just a placeholder to show how to use the access token
        print(f"Calling API endpoint: {endpoint}")
        print(f"Using access token: {self.access_token[:10]}...")
        
        # Example of how you would make the actual API call:
        # headers = {"Authorization": f"Bearer {self.access_token}"}
        # response = requests.get(f"https://api.pax8.com{endpoint}", headers=headers)
        # return response.json()
        
        return {"message": "This is a placeholder for the API response"}

from flask import Flask, request, redirect, jsonify

app = Flask(__name__)
app.secret_key = "your-secret-key"  # Replace with a real secret key

### Create an instance of the Pax8AuthClient
auth_client = Pax8AuthClient()

@app.route("/login")
def login():
    """Step 1: Redirect user to Pax8 authorization page"""
    auth_url = auth_client.get_authorization_url()
    return redirect(auth_url)

@app.route("/callback")
def callback():
    """Step 2: Handle the callback and exchange code for tokens"""
    code = request.args.get("code")
    
    try:
        auth_client.exchange_code(code)
        return "Authorization successful! You can now use the access token to call Pax8 APIs."
    except Exception as e:
        return f"Error: {str(e)}", 400

@app.route("/api-example")
def api_example():
    """Example of calling an API with the access token"""
    try:
        # This is just a placeholder - replace with your actual API endpoint
        result = auth_client.call_api("/your-api-endpoint")
        return jsonify(result)
    except Exception as e:
        return f"Error: {str(e)}", 400

if __name__ == "__main__":
    app.run(debug=True)