Skip to main content

API

Apps: Integrations That Act on Your Store

See which integrations can read or change your store through the API, what each one may do, and remove one in a click. Register your own integration to get a client ID and secret.

Overview

Settings → Apps has three parts:

  • Installed apps — every integration you have approved, with the access it holds and when it was last used. Remove stops its access straight away.
  • Register an app — creates a client ID and secret for an integration you build or commission.
  • Registered apps — the integrations you have registered.

Apps are part of every plan. They hand out standing access to your store, so this page is for the store owner. If you use two-factor authentication, registering an app, issuing a new secret and deleting an app each ask for a code from your authenticator app. One code covers further actions for five minutes.

Installed apps

Each installed app shows its name, its developer's email address, the start of its access token, when it was last used, and the access it holds, such as orders:read products:write. An app marked Removed no longer has access.

Remove on an installed app:

  • stops its token working immediately;
  • cancels any approval codes it has not used yet;
  • switches off the webhook endpoints it created.

Removing is recorded in the audit log. To give the app access again, approve it again from the app.

Register your own app

Register an app when an integration needs to act on your store, such as a warehouse or accounting connection you control.

  1. Enter the App name, the Developer email and the Redirect URI: the https:// address the app is sent back to after you approve it.
  2. Choose the Scopes this app may request: products:read, products:write, orders:read, orders:write, customers:read, inventory:read, inventory:write, webhooks:read and webhooks:write. The webhooks scopes let the app see and manage its event subscriptions instead of polling.
  3. Click Register, and enter your two-factor code if asked.
  4. The client ID and client secret appear once. Copy both, keep the secret somewhere safe, and click I have saved it. The secret cannot be shown again.

A redirect URI must start with https:// (or http:// on localhost) and carry no # part. An app you register can be installed only on your own store.

Copy ID copies an app's client ID again.

New secret issues a fresh client secret and shows it once, like the first one. The old secret stops working at once: the app can no longer exchange approvals for tokens with it, so update the integration straight away. Tokens the app already holds keep working until you remove the install. Issuing a new secret is recorded in the audit log.

The bin deletes the app: every install of it stops working, and its unused codes are cancelled.

How an app gets access

Registering does not give an app access by itself. The app sends you to BestWebby's approval screen, which shows its name and the access it asks for. Nothing is granted until you approve. The app then exchanges the approval for its own token, limited to the scopes you approved, and uses it with the BestWebby API.

Developers: the approval screen, the token exchange and how the token is used are in the API reference.

Common questions

How is an app different from an API key? An API key (Settings → API keys) is for your own scripts. An app is approved on an approval screen, shows here with the access it holds, and is removed in one click.

I lost the client secret. Can I see it again? No. Click New secret on the app, copy the new one, and update the integration. The client ID stays the same.

Why am I asked for a code when I delete an app? Deleting an app ends every install of it, so with two-factor authentication on it needs a fresh code, the same as registering one.