Connect flow (Flow B)

This is the flow when the merchant starts from your product — a "Connect Bito" button in your own UI. You send the merchant to the Bito login page, Bito authenticates them, and Bito redirects back to you with an authorization code in the query string.

Your app                 Merchant browser              Bito
   |                            |                        |
   |  1. redirect to            |                        |
   |     id.bito.uz/oauth/auth  |                        |
   |--------------------------->|                        |
   |                            |  2. log in             |
   |                            |     (phone + password) |
   |                            |----------------------->|
   |                            |                        |
   |                            |  3. pick account,      |
   |                            |     approve scopes     |
   |                            |----------------------->|
   |                            |                        |  code, 20 min TTL
   |                            |  4. redirect back      |
   |                            |     ?code=X&state=Y    |
   |                            |<-----------------------|
   |  callback?code=X&state=Y   |                        |
   |<---------------------------|                        |
   |                                                     |
   |  5. POST /auth/oauth/token                          |
   |---------------------------------------------------->|
   |     { access_token, refresh_token, expires_in }     |
   |<----------------------------------------------------|

1. Send the merchant to Bito

https://id.bito.uz/oauth/auth
  ?response_type=code
  &client_id=<client_id>
  &redirect_uri=<url-encoded callback>
  &scope=<scopes>
  &state=<random csrf string>

Example

https://id.bito.uz/oauth/auth?response_type=code&client_id=69c50a2d50f7b939923a469b&redirect_uri=https%3A%2F%2Fexample-app.com%2Fcallback&scope=admin&state=xcoiv98y2kd22vusuye3kch

Parameter	Required	Description
response_type	Yes	Must be code
client_id	Yes	Your OAuth client id
redirect_uri	Yes	URL-encoded callback. Send the redirect_uri registered on your integration.
scope	Yes	Requested scopes: admin, read, write, delete
state	Strongly recommended	Opaque random value. Bito returns it unchanged — compare it on the way back to stop CSRF.

/oauth/auth is the canonical authorize address. If the merchant is not signed in yet, Bito sends them to the login page with the same parameters and resumes the authorization after they sign in.

2. The merchant authenticates

Bito owns this screen entirely. The merchant enters their phone number and password, picks which account to grant access to if they own several, and approves the scopes you asked for.

The merchant must be the owner or an additional owner of the chosen account — an ordinary employee cannot connect it. The account's onboarding must also be complete, otherwise exchanging the code for tokens is refused.

INFO

You do not implement any login UI, and you never see the merchant's password.

3. Bito redirects back with the code

https://example-app.com/callback?code=abc123def456&state=xcoiv98y2kd22vusuye3kch

Parameter	Description
code	The authorization code. Single use, expires in 20 minutes.
state	The exact value you sent in step 1. Reject the callback if it does not match.

4. Exchange the code for tokens

Same call as Flow A: Working with tokens → Exchanging the authorization code.

WARNING

The exchange must happen server-side. Anything holding your client_secret is your backend, never the merchant's browser.