Build an app

A BazaarSaaS app is your own web service that works with stores that install it — for example an accounting export, a WhatsApp marketing tool, a review importer or a warehouse sync. It runs on your server and talks to each store through the public API and webhooks, with a token the merchant grants when they install it.

1. Get a store to work in

Create a store — it's free. You register your app from its admin, and it's also your test store.

2. Register the app

Admin → Apps → enter the app name and your redirect URI (where merchants come back after approving, e.g. https://myapp.example.com/bazaarsaas/callback). You get a client id and a client secret — the secret is shown once; store it safely on your server.

3. Ask for only the access you need (scopes)

4. The install (OAuth) flow

1. Send the merchant to their store's consent page (they must be signed in to their admin):

   https://<store-address>/oauth/authorize?clientId=<client id>&redirectUri=<your redirect URI>&scope=products:read%20orders:read&state=<random>
   

2. They see "Install your app? It will be able to: …" in plain words and approve.

3. BazaarSaaS sends them to your redirect URI with ?code=…&state=…. Check that state is the one you sent.

4. Exchange the code for a token from your server:

   curl -X POST https://<store-address>/oauth/token \
     -d grant_type=authorization_code -d client_id=<client id> -d client_secret=<secret> \
     -d code=<code> -d redirect_uri=<your redirect URI>
   

   → { "access_token": "bzoauth_…", "token_type": "Bearer", "scope": "products:read orders:read" }

Keep the token per store; it only works for the scopes the merchant approved.

5. Use the API and webhooks

Call /api/public/… on the store's address with Authorization: Bearer bzoauth_… — endpoints are in API & webhooks. With webhooks:write, register your endpoint through POST /api/public/webhooks to receive order.confirmed and order.shipped, signed with X-BazaarSaaS-Signature.

6. When a merchant uninstalls

The app's token stops working, its webhooks are switched off, and you receive one last app.uninstalled webhook — delete that store's data you no longer need.

7. List it in the Marketplace

Admin → Apps → your app → List in marketplace: name, category, summary, details, screenshot links, the scopes it needs, pricing (free, one-time or monthly with optional trial days), developer name and support email.

Submitting sends it to the BazaarSaaS team, who read it, test-install it with exactly those scopes and approve or reject it with a reason. Approved apps appear in every store's Marketplace; any later change to the listing is reviewed again (stores that already installed it keep it meanwhile). Paid apps are charged on the merchant's BazaarSaaS invoice — monthly apps only for whole months after the trial, and never after uninstalling.

Checklist before you submit

• Ask for the smallest set of scopes; explain in the listing why you need each one.
• Verify webhook signatures and the OAuth state.
• Handle app.uninstalled, and keep secrets and tokens only on your server.
• Give merchants a support email that answers.