Spree Admin SDK
Describe what a client is asking for
What the consent screen shows the merchant: who is asking, the permissions the requested scopes imply, and of those, the ones this person can actually hand over.
A grant only ever narrows the approver’s own authority, so anything they do not hold themselves is not offered.
GET
Spree Admin SDK
Authorizations
JWT token for admin user authentication
Query Parameters
The application's client id
Must match what the application registered
Always code
Space-delimited permission keys, the same vocabulary as API-key scopes
PKCE challenge. Required: these clients are public
Always S256
RFC 8707: which protected resource the token is for

