How to call grantless operation? about amazon-sp-api

[amz-tools]

Hi!

I can reproduce your error and I think I found the issue. We missed the different way of requesting an access token for grantless operations as stated here in the docs.

We have to change grant_type to "client_credentials" and use "scope" instead of "refresh_token" for all grantless operations. Its a bit complicated as we would basically have to have two different access tokens depending on the operation and as a result also two token refresh calls.

We will think about whats the best solution and will come up with a fix. For the time being you could make it work by just copying the "refreshAccessToken" function in the SellingPartner.js, rename to lets say "refreshGrantlessAccessToken" and just change the body of the request to the following:

body:JSON.stringify({
  grant_type:'client_credentials',
  scope:'sellingpartnerapi::notifications',
  client_id:this._credentials.app_client.id,
  client_secret:this._credentials.app_client.secret
})

If you then replace the await sp.refreshAccessToken in your code with await sp.refreshGrantlessAccessToken the call to getDestinations should work.

[michael-land]

Thanks, it works

[amz-tools]

Just uploaded a new version (0.3.3) that includes support for grantless operations. Looking at your example you could now just add the scope of the grantless operation to the refresh like this:
await sp.refreshAccessToken('sellingpartnerapi::notifications')
Alternatively as it seems you didn't change the "auto_request_tokens" option (which is true by default) you could also just skip refreshAccessToken and refreshRoleCredentials calls as this will be done automatically by the client.
More information on the topic can be found in the Readme.