OAuth 2.0 authorization code flow for marketplace/platform integrations.

The token endpoint needs no prior credentials, so bootstrap it with a tokenless client — Mercadopago.new(nil) — and keep the app secret in the request body:

verifier = Mercadopago.OAuth.generate_code_verifier()

url =
  Mercadopago.OAuth.get_authorization_url(app_id, redirect_uri, state,
    code_challenge: Mercadopago.OAuth.code_challenge(verifier)
  )

# ...redirect the seller to `url`, then on the callback:

{:ok, %{status: 200, response: %{"access_token" => token}}} =
  Mercadopago.OAuth.create(Mercadopago.new(nil), %{
    client_id: app_id,
    client_secret: app_secret,
    code: code,
    redirect_uri: redirect_uri,
    code_verifier: verifier
  })

Store verifier in the user's session alongside state; both must survive the redirect. PKCE is optional on MercadoPago today, but it removes the value of an intercepted authorization code and costs nothing to include.