Activation with Brand authentication

Brand-level authentication and onboarding allows brand on Wolt to access marketplace APIs for any venue belonging to the brand entity using a single access token.

This page is intended for brand partners who wish to integrate with Wolt and use brand-level authentication. It covers what partners need to build and how they can test the implementation.

Eligibility for Brand OAuth

How do I know if I can use Brand Authentication?

You can verify eligibility in the Wolt Merchant Admin by checking if you have access to a Brand-level business entity. Your Wolt account manager could also guide you throught the selection of Integration onboarding method

Checklist

To implement the brand integration onboarding flow, you need to implement specific components listed below.

1. Provide the technical information required to setup your integration entity to Wolt:

  • Order webhook URL: The URL where Wolt sends order notifications.

  • Order webhook client secret: A secret key for verifying that order notifications are sent from Wolt.

  • Order events which trigger notifications. A list of events for which you want to receive notifications. Supported events include CREATED, PRODUCTION, READY, DELIVERED, and CANCELED.

  • Emails and phone numbers Contact information for test accounts provided by Wolt, which you can use to test the integration.

  • All URLs must be encrypted with TLS (https) and have a valid certificate

2. Receive integration entity credentials from Wolt:

  • OAuth2 client credentials:

    • access_token that you can use to access marketplace APIs.

    • refresh_token the key to request new access token

    • client_id, client_secret – your integration identification

  • Accesses to Wolt account and test venue. Access to Wolt accounts and test venues for building and testing the integration onboarding flow.

  • Postman collection that provides an overview of available endpoints to assist with development and testing.

Authentication

Venues integrated through the brand integration onboarding authenticate with Wolt APIs using OAuth 2.0. For more details on how authentication works, see integration onboarding authentication.

Testing the implementation

During the build stage, Wolt provides several venues for testing your integration. In the development environment, you can perform integration onboarding on test venues as many times as needed.

  1. Integrate a venue via the Self-Service Integration Onboarding Flow: Follow the onboarding process to integrate a test venue.

  2. Exchange the authorization code for access and refresh tokens: Once you complete the integration on Wolt, ensure that your system automatically exchanges the authorization code for access and refresh tokens.

  3. Obtain the Wolt venue ID from the access token: The venue ID may be required for subsequent requests. See the detailed process in our dedicated guide.

  4. Verify the access token: Confirm that the access token works by performing the following actions for the venue and its menu.

    • Create a menu

    • Set the venue's opening hours

    • Update the venue’s online status

    • Test the order flow:

      • Submit an order from the Wolt test website (accessible via Merchant Admin → Venue → Menu editor → View on Wolt.com, or contact your account manager).

      • Use Adyen test cards (consumer card type) for payment methods.

      • Use the endpoints provided in the Order API to ensure the token works for your specific use case.

  5. Obtain a new access token with the refresh token: Use the refresh token to obtain a new access token.

    • Ensure your system does not perform parallel requests to refresh the token.

    • Simulate scenarios where your system fails to persist the refresh token, verify fallback mechanisms to prevent token loss.

    • Confirm that your system refreshes the tokens within a 30-day window to avoid expiration due to inactivity.

  6. Re-verify the Access Token: Repeat step 4 to confirm that the token continues to function properly.

  7. Reset the test integration: Call the designated endpoint to reset the test integration, making the venue available for the next test run.