# Implementation

## 1. Open a sandbox account

Sign up for a [SeedLink Dashboard](https://app.seedlink.dev) account with just your email. Every account starts in sandbox — free, pre-seeded with test data, no real Metrc or BioTrack credentials required to start building.

## 2. Get your API credentials

Generate a `client_id` and `client_secret` in the [SeedLink Dashboard's](https://app.seedlink.dev) API Keys page. Exchange them for a Bearer token:

```bash
curl -X POST https://api.seedlink.dev/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "sl_cid_...",
    "client_secret": "sl_csec_..."
  }'
```

A few things to know about the token you get back:

- Send it as `Authorization: Bearer <access_token>` on every call.
- It expires after an hour.
- You also get a `refresh_token`. Use it to get a new access token without re-sending your `client_secret`.
- Most integrations handle refreshing once, in a thin wrapper around outgoing requests. It's not something you think about per call.

## 3. Embed the Connect SDK

Create a link token on your server, using the Bearer token from step 2:

```bash
curl -X POST https://api.seedlink.dev/v1/link/token/create \
  -H "Authorization: Bearer sl_at_..." \
  -H "Content-Type: application/json" \
  -d '{ "metadata": { "user_id": "usr_abc" } }'
```

Pass that link token to the SDK on the client to display the widget:

```javascript
const connect = SeedlinkConnect.create({
  token: linkToken,
  onSuccess: (publicToken) => {
    // send publicToken to your server
  },
})
connect.open()
```

**Linking Metrc and BioTrack accounts**

The widget walks your user through picking their state system and entering their login. Their credentials go straight to SeedLink, never through your app. On success, you get a `public_token`. Exchange it server-side for a `connection_id`:

```bash
curl -X POST https://api.seedlink.dev/v1/link/token/exchange \
  -H "Authorization: Bearer sl_at_..." \
  -H "Content-Type: application/json" \
  -d '{ "public_token": "pt_..." }'
```

Store the `connection_id`. It's how you'll reference this user's linked account going forward.

## 4. Make API calls

Every request needs your Bearer token and a `connection_id` together:

```
Authorization: Bearer <access_token>
GET https://api.seedlink.dev/v1/connections/{connection_id}/facilities/{facility_id}/packages
```

Every response comes back in the same envelope:

```json
{
  "data": [ ... ],
  "meta": { "request_id": "req_a1b2c3d4", "provider": "metrc", "state": "CA" },
  "pagination": { "page": 1, "per_page": 25, "total": 47 }
}
```

## 5. Going live

Everything above runs in sandbox by default: free, pre-seeded, no real credentials required. Moving to production is a plan switch, not a code change. Reach out to **core@seedlink.dev** when you're ready to go live.