## Overview
Weimob Cloud product apps come in self-owned (merchant self-developed) and tool (ISV multi-merchant) flavors. Self-owned apps use the OAuth2 client_credentials grant: POST to this endpoint with grant_type=client_credentials, client_id, client_secret plus shop_id/shop_type in the query. The token lives for 2 hours — cache and reuse it, because hammering the token endpoint triggers throttling.
### Steps
1. Create a self-owned product app in the Weimob Cloud console; find client_id/client_secret under Overview > Dev Config and bind a test shop to the app.
2. Exchange for the access_token (access_token field in the response).
3. Apply for the needed API capabilities (orders, goods, ...) in the Capability Center; calls fail until approved.
4. Business calls follow https://dopen.weimob.com/api/1_0/{path}?accesstoken=xxx.
### Response
Success: {"code":{"errcode":"0","errmsg":"success"},"data":{"access_token":"...","expire_in":7200,...}}. A non-"0" errcode comes with an errmsg.
### Notes
- Errors live in code.errcode while payload lives in data — never judge business success by the HTTP status alone.
- Tokens are shop-scoped (shop_id); multi-shop merchants must maintain one token per shop.
### Tool-app contrast
Tool (ISV) apps obtain tokens through the merchant authorization-code flow instead of client_credentials, and the returned token carries the authorizing shop's scope. Mixing the two flows in one codebase produces confusing 401s — keep separate credential records per flow type, label them clearly in the integration console, and never reuse a self-owned token for a tenant that authorized through the tool flow.