OmniAuth Printful

This gem contains the Printful strategy for OmniAuth.

Add to your Gemfile:

gem 'omniauth-printful'

Then run bundle install.

Register an application in the Printful Developer Portal to obtain a client id and client secret, and configure its redirect URL to point at your callback route (by default /auth/printful/callback).

Add the strategy to your OmniAuth builder:

use OmniAuth::Builder do
  provider :printful, ENV['PRINTFUL_CLIENT_ID'], ENV['PRINTFUL_CLIENT_SECRET']
end

In Rails, this typically lives in config/initializers/omniauth.rb:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :printful, ENV['PRINTFUL_CLIENT_ID'], ENV['PRINTFUL_CLIENT_SECRET']
end

Printful uses scopes to limit what an access token may do (for example orders, stores_list, sync_products, file_library, webhooks). The scopes available to your token are configured for your app in the Developer Portal. You can request a specific set at runtime with the scope option:

provider :printful, ENV['PRINTFUL_CLIENT_ID'], ENV['PRINTFUL_CLIENT_SECRET'],
         scope: 'orders stores_list'

Printful's OAuth 2.0 implementation departs from the specification in a few ways. This strategy handles them for you, but they are worth knowing about:

• Authorize request uses a redirect_url parameter instead of the standard redirect_uri.
• Token exchange sends the client credentials in the request body and does not accept a redirect_uri. The strategy sets auth_scheme: :request_body and omits the redirect parameter accordingly.
• Denied authorization comes back as success=0 rather than a standard error parameter. The strategy translates this into a clean OmniAuth :access_denied failure.

State verification is enabled by default. If you find authentications failing with :csrf_detected, Printful is not echoing the state parameter back on the callback; disable the check with:

provider :printful, ENV['PRINTFUL_CLIENT_ID'], ENV['PRINTFUL_CLIENT_SECRET'],
         provider_ignores_state: true

In Rails, the request phase is still protected against CSRF by omniauth-rails_csrf_protection, which requires the request phase to be initiated with a POST.

After a successful authentication, request.env['omniauth.auth'] looks like this (the uid is the authenticated Printful store's id):

{
  "provider" => "printful",
  "uid" => "10",
  "info" => {
    "name" => "My Store"
  },
  "credentials" => {
    "token" => "...",
    "refresh_token" => "...",
    "expires_at" => 1718000000,
    "expires" => true
  },
  "extra" => {
    "raw_info" => {
      "code" => 200,
      "result" => [
        { "id" => 10, "name" => "My Store", "type" => "native" }
      ]
    }
  }
}

After checking out the repo, run bundle install, then run the tests and linter:

bundle exec rspec
bundle exec rubocop

Released under the MIT License.