Tiendanube OAuth callback
Exchanges the authorization code, stores an unlinked installation, issues a one-time claim cookie, and redirects to Fluxis. Tokens missing any of the four Payment App scopes fail with reason=insufficient_scope. TIENDANUBE_PRE_PAYMENTS_API_MODE=true is an explicit opt-in that accepts a token whose only missing Payment App scopes are read_payments and write_payments; the installation stays pending_provider_provisioning and is never marked active.
query Parameters
codeAuthorization code
stateServer-side OAuth state
errorAuthorization rejection code
Tiendanube OAuth callback › Responses
Redirects with status=pending_account_link or status=authorization_failed
Tiendanube Process Payment
Verifies RSA and callback-token auth, creates a pending Fluxis PaymentRequest on the dedicated POS, and returns the hosted checkout URL. Optional extra.callback_urls {success,failure,cancel} is normalized against the installation store-domain snapshot and stored immutably on the attempt. An entirely absent extra remains accepted for legacy retries; a partial or malformed callback object is invalid_request. Success is a raw partner JSON body, not the Fluxis API envelope.
Headers
AuthorizationBearer callback token from Payment Provider authentication.type=token
X-TimestampUnix seconds or RFC3339 timestamp included in the signed string
X-SignatureRSA-SHA256 signature of URL|timestamp|SHA-256(raw body)
Tiendanube Process Payment › Responses
Created
redirect_urlTiendanube Cancel Payment
Verifies RSA and callback-token hash auth, then idempotently cancels the payment attempt. Unpaid PaymentRequests are expired; funded ones stay put. Success is raw JSON {}, not the Fluxis API envelope.
query Parameters
payment_attempt_idTiendanube payment.attemptId
Headers
AuthorizationBearer callback token from Payment Provider authentication.type=token
X-TimestampUnix seconds or RFC3339 timestamp included in the signed string
X-SignatureRSA-SHA256 signature of URL|timestamp|SHA-256(raw body)
Tiendanube Cancel Payment › Request Body
Decision Table
| Variant | Matching Criteria |
|---|---|
| type = object | |
| type = object |
Tiendanube Cancel Payment › Responses
Tiendanube Payment Status
Verifies RSA and callback-token hash auth, then returns the wrapped official Transaction list for one order. Empty orders are HTTP 200 with transactions=[]. Success is raw partner JSON, not the Fluxis API envelope. The path is read-only.
query Parameters
order_idTiendanube order_id (cartId)
Headers
AuthorizationBearer callback token from Payment Provider authentication.type=token
X-TimestampUnix seconds or RFC3339 timestamp included in the signed string
X-SignatureRSA-SHA256 signature of URL|timestamp|SHA-256(raw body)
Tiendanube Payment Status › Responses
Tiendanube app uninstalled webhook
Tiendanube customers data request webhook
After HMAC verification, enqueues a durable customers/data_request on the transactions SQS queue and returns 200. Enqueue or configuration failure returns 500 so Tiendanube retries. The queued message carries only the integration id and Account/Store-scoped lookup HMACs. The webhook body is not persisted.
Headers
X-Linkedstore-Hmac-Sha256Hex HMAC-SHA256 of the raw body
Tiendanube customers data request webhook › Responses
Acknowledged
Tiendanube customers redact webhook
After HMAC verification, anonymizes Tiendanube BuyerIdentity rows for this store's POS. Matching uses a single OR on store-scoped customer HMAC and Account-scoped email HMAC; guests without a customer id only populate the email branch. PaymentRequests, amounts, attempts, and chain transactions are retained. Duplicate deliveries are idempotent.
Headers
X-Linkedstore-Hmac-Sha256Hex HMAC-SHA256 of the raw body
Tiendanube customers redact webhook › Responses
Acknowledged
Tiendanube store redact webhook
Erases store profile, credentials, dedicated POS display data, and attempt return URLs. Retains payment attempts, PaymentRequests, transactions, amounts, remote transaction IDs, Account/POS linkage, and audit timestamps.
Headers
X-Linkedstore-Hmac-Sha256Hex HMAC-SHA256 of the raw body
Tiendanube store redact webhook › Responses
Acknowledged