We would like to roll out support for Clover in our restaurant ordering app platform, and I have questions about how/if we can implement the oauth workflow as outlined in your docs as this seems geared specifically toward apps that would be used by the merchants themselves rather than by the end customers of a restaurant as is the case with our apps.
We work with different restaurants, and our customer ordering apps fetch merchants/locations, menu items (including categories and modifiers); we would also like to insert customers and itemized orders if possible. We integrate with Spreedly to allow customers to store credit cards for future use, as many POS APIs do not support such functionality. I have all of this working very well for Clover merchants with the exception of the itemized order creation (really just haven't gotten to that yet). We are getting successful responses back from your endpoints using both the sandbox and production us api urls. However, currently in our server-side requests to your APIs we are using the auth tokens generated through the dashboard (
https://www.clover.com/setupapp/m/<merchant_id>/api-tokens). We create an unpublished app for each merchant, and we are able to store this merchant-specific access token securely on our servers. Leaving things as such would work very well for our purposes.
My concern is the strongly worded requirement that we must use oauth to generate the tokens programatically -- this would be totally fine if it could indeed be done programmatically because this would definitely need to happen server-side in our case. However the oauth workflow requires direct interaction from the merchant since the initial authorize request redirects to the clover login page. Is there a way around this? Can we continue using the access tokens generated through the dashboard? The authorization tokens are never sent to the client apps and are only dealt with on our server. We haven't rolled this integration to production as of yet, and I certainly do not want our developer account to be terminated per the warning but I do not see practical way of meeting the specific oauth workflow in our case.
Our apps do not require any write access for inventory and employee management as we are simply reading in menus to allow customers to place orders (we also give restaurants an in store dashboard with an order fulfillment screen, but this does not need to interact with Clover's APIs); the inserting customers and itemized orders is desired to allow merchants to benefit from whatever dashboard reporting features clover may offer for orders placed through our apps.
Thank you in advance for your help.
