Additional Features/
Braintree Auth (Beta)/
Server-side Connect Flow

Server-side Connect Flow

the first step in the Connect integration is to set up the connect_url. This URL is where the merchant will be sent after clicking the Connect with Braintree button, starting the OAuth flow. It is built by the Braintree server SDK.
  1. PHP
$gateway = new Braintree\Gateway([ 
    'clientId' => 'use_your_client_id', 
    'clientSecret' => 'use_your_client_secret' 
]); 
$url = $gateway->oauth()->connectUrl([ 
    'redirectUri' => '<a href="https://your.redirect.uri">https://your.redirect.uri</a>', 
    'scope' => 'transaction:sale,customer:create', 
    'state' => 'foo_state', 
    'landingPage' => 'login', 
    'loginOnly' => 'false', 
    'user' => [ 
        'country' => 'USA', 
        'email' => 'foo@example.com' 
    ], 
    'business' => [ 
        'name' => '14 Ladders', 
        'registeredAs' => '14.0 Ladders' 
    ], 
    'paymentMethods' => [ 
        'credit_card', 
        'paypal' 
    ] 
]);

Redirect URIAnchorIcon

The redirect URI is where the merchant is returned when the OAuth flow is complete or if they chose to finish later. All redirect URIs must be allowlisted as part of your OAuth configuration.

ScopeAnchorIcon

The transaction:sale and customer:create scopes shown in the example allow your integration to create transactions and customers for the connected merchant. Request only the scopes required for the API operations your integration performs. For read-only access, request the corresponding resource scopes, such as transaction:find or customer:find.

To request multiple scopes, pass them as a comma-separated string. See the OAuth Reference for all supported scopes.

StateAnchorIcon

The state parameter is part of the OAuth 2.0 specification and used to prevent Cross Site Request Forgery (CSRF) attacks. Braintree will always return the submitted state verbatim along with the access code when redirecting back to the redirect URI. You can verify the authenticity of the request to the redirect URI by submitting a non-guessable state parameter when initiating the Connect flow and ensuring the value returned matches the value submitted. You should ensure that the contents of the state parameter are properly escaped (typically via base 64 or URL encoding) to prevent them from being altered by a merchant's browser when redirecting at the end of the OAuth flow.

Landing pageAnchorIcon

The first page all merchants see when clicking Connect with Braintree is the cobranded login page. For merchants who choose not to use Login with PayPal, the optional landing_page parameter determines whether they are initially presented with the Braintree login. The valid value that can be passed to this parameter is login. If this parameter is not provided, the landing_page will default to login.

Supporting login-onlyAnchorIcon

Set login_only to true in the Connect URL to ensure only existing Braintree merchants can connect to your platform. If this parameter is not specified, merchants can either sign up for a new account or log into an existing account by default.