# Connect Merchant

All Teya merchants have a Teya account. The merchant needs to connect their Teya account to the ePOS application so that the ePOS can make API calls on the merchant's behalf.

Depending on the type of ePOS, you will need to implement a different OAuth flow to authenticate your Teya merchants.

- Browser-based ePOS applications should follow [this guide](/poslink/authenticate#create-authorisation-and-redirect-urls)
- On-premise ePOS installations should follow [this guide](/poslink/authenticate#device-code-flow)


Once you have authenticated your Teya merchant, the ePOS application will receive an access token and refresh token for the given user. You should use these in the API calls below.

## Login experience

Below is a suggested user journey for a merchant to connect their Teya account in your ePOS application:

1. The merchant goes to an integration setup tab
2. Select Teya
3. Enter email address to initiate linking flow

### Teya account login flow
1. The merchant will be sent an email to complete their setup (if they have never logged in before)
2. They are prompted to set a password
3. The merchant returns to login page and enters their credentials
4. ePOS is now connected to the merchant's Teya account

```tabs
    tab:
      title: Login screen
      content:
        ![poslink-login-step-1.png](/poslink/images/poslink-login-step-1.png)
    tab:
      title: Setup email
      content:
        ![poslink-login-step-2.png](/poslink/images/poslink-login-step-2.png)
    tab:
      title: Received email
      content:
        ![poslink-login-step-3.png](/poslink/images/poslink-login-step-3.png)
    tab:
      title: Set password
      content:
        ![poslink-login-step-4.png](/poslink/images/poslink-login-step-4.png)
    tab:
      title: Setup complete
      content:
        ![poslink-login-step-5.png](/poslink/images/poslink-login-step-5.png)
```

## Logout when needed

It is highly suggested that the user should be able to log out or be prompted automatically to re-authenticate whenever your ePOS detects that both the Access and Refresh tokens are invalid.

For example, in an unhappy path scenario where this will be needed: a timeout may occur between the ePOS and Teya ID during the refresh of the tokens, causing the Refresh Token to expire before receiving it back. Subsequently, every call will fail because the tokens are invalid.

```admonition
icon: fas fa-exclamation-triangle
title: To revoke the Access or Refresh token you just needed to call the IdP revocation_endpoint:
content: |
    https://id.teya.com/oauth/v2/oauth-revoke
    
    Passing the following parameters:
    - `client_id`
    - `client_secret`
    - `token`
    - `token_type_hint` (e.g. `refresh_token or access_token`)
    
    You need to make sure you call this endpoint twice; one for the Refresh Token and another for the Access Token.
```

```shell title="Examples requests"
curl -d "client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&token=<TOKEN>&token_type_hint=refresh_token" -X POST https://id.teya.com/oauth/v2/oauth-revoke

curl -d "client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&token=<TOKEN>&token_type_hint=access_token" -X POST https://id.teya.com/oauth/v2/oauth-revoke
```

**In case of success the response code will be 200.**