tray-autorizacao

Manage OAuth 2.0 token lifecycle for Tray API access.

14|Updated Mar 21, 2026
One-click install
npx skills add https://github.com/tray-tecnologia/tray-api-claude-plugin --skill tray-autorizacao
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: tray-autorizacao
Source: https://github.com/tray-tecnologia/tray-api-claude-plugin/tree/main/skills/autorizacao
Command: npx skills add https://github.com/tray-tecnologia/tray-api-claude-plugin --skill tray-autorizacao

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implements the complete OAuth 2.0 authorization flow and token lifecycle for Tray API integrations, removing guesswork about token exchange, renewal, error handling, and per-store API addresses so developers can authenticate stores reliably.

Core Features & Use Cases

  • Three-step OAuth flow: guidance for redirecting merchants, handling callbacks, and exchanging authorization codes for access and refresh tokens.
  • Token lifecycle management: renewal guidance for access_token (3 hours) and refresh_token (30 days), plus recommended scheduling and storage practices.
  • Error handling & limits: mappings for authentication error codes (1000–1003, 1099), HTTP responses (401, 429), and advice for exponential backoff and rate-limit strategies.
  • Use case: first-time store onboarding where the app obtains consumer credentials, completes the redirect/callback flow, stores api_address per store, and schedules automatic token refresh before expiry.

Quick Start

Redirect the merchant to Tray authorization, capture the callback code, and exchange it for access and refresh tokens using your consumer_key and consumer_secret.

Frequently Asked Questions about tray-autorizacao

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement the Tray OAuth 2.0 authorization flow for store onboarding?

To implement Tray OAuth 2.0, redirect merchants to the authorization URL, capture the callback code, and exchange it using your consumer key and secret to obtain access and refresh tokens for API authentication.

How do I manage Tray API token refresh before the access_token expires?

Manage Tray API token refresh by scheduling automatic renewals before expiry. The access_token expires in 3 hours and the refresh_token in 30 days, requiring a scheduled renewal strategy to maintain continuous API access.

What do Tray API authentication error codes 1000 to 1003 and 1099 mean?

Tray API authentication error codes 1000 through 1003 and 1099 indicate specific OAuth failures during token exchange or API requests. The Skill maps these codes alongside HTTP 401 and 429 responses for proper error handling and backoff.

How should I handle Tray API rate limits and HTTP 429 responses?

Handle Tray API rate limits and HTTP 429 responses by implementing an exponential backoff strategy. This ensures authentication requests are retried safely without overwhelming the API or causing credential lockouts.

Do I need to store the api_address separately for each store during Tray authentication?

Yes, you need to store the api_address per store during Tray authentication. Capturing and saving the specific api_address returned during the OAuth flow ensures subsequent API requests route to the correct store endpoint.

What is the best way to securely store Tray API access and refresh tokens?

The best way to store Tray API tokens is using secure credential storage practices that protect access and refresh tokens. Proper storage prevents unauthorized access while allowing scheduled retrieval for automatic token lifecycle management.