Anything that works with a business's own data: an integration with another system, a screen that opens inside the admin, a block or section for the storefront, or a job that runs on a schedule. An app reads and writes through a GraphQL API, receives platform events as webhooks and keeps its secrets on the platform.

How does a merchant know what my app can access?

An app declares its scopes, such as read:orders, read:customers or read:content. Before anything is installed the merchant sees that list on the consent screen, and the API refuses anything outside it. A later version that asks for more scopes needs a fresh approval.

Can my app see another business's data?

No. An app is installed into a business, and the tokens it receives act for that installation, inside the scopes that merchant approved. Screens inside the admin use short-lived session tokens that are exchanged and refreshed, and your server uses its own API token.

How do I get notified when something changes?

Subscribe to the platform events your app needs, such as order.created, order.paid or cms.entry.published. Some events also need a scope, such as read:content for content events. Deliveries are signed with your app's secret so you can check they came from the platform, and the delivery log lets you see what was sent and replay a delivery.

Are apps reviewed before merchants get them?

Yes. You ship an app in versions and submit a version for review before it reaches merchants in the marketplace. A development app skips review, because it installs only on stores its developer owns.

Where is the documentation?

The developer documentation is public, and an API reference with Postman and OpenAPI exports is available to signed-in developers with access to it.

Home
Features
Developer platform

For developers, agencies and builders

Build your own apps on the data the business already runs on

A scoped API, screens that open inside the admin, blocks for the storefront, signed webhooks and a review before your app reaches the marketplace.

Read the developer docs Create your business free

The developer docs are public. You do not need an account to read them.

Order sync

wants access to your business

v1.2

read:orders
read:customers
read:content

query {
  orders(first: 5) {
    nodes { id  totalMinor  status }
  }
}

Cancel Install

What it does

12 things developer platform does for you

The same circles as the features map, grouped by the part of the day they help with.

Developer platform

Partner centre Register as a publisher, invite your team and manage every app you build.
Custom apps A development app installs only on stores you own, for testing or private use.
App marketplace Merchants browse listed apps and install them into their business.
Install consent The install screen lists every scope an app asks for before it gets access.
Scoped GraphQL API An app reads and writes only what the scopes the merchant granted allow.
Embedded screens Apps open inside the admin, signed in with short-lived session tokens.
Storefront blocks Apps contribute blocks and sections to the storefront and the page builder.
Signed webhooks Platform events delivered to your app, with a delivery log and replay.
Schedules Apps declare scheduled tasks the platform triggers on time.
App secrets Keep an app's keys and secrets on the platform, not in its code.
Versions & review Ship a version and submit it for review before it reaches merchants.
Developer docs Public documentation for building apps, plus an API reference with Postman and OpenAPI exports.

How it works

Three steps from sign up to your first app

1
Register as a publisher

Open the partner centre, create your publisher and invite the people you build with.
2
Create the app and its scopes

Name it, declare the scopes it needs, add secrets and schedules, and subscribe to events.
3
Ship a version

Test install it on stores you own, or submit a version for review and list it in the marketplace.

delivery attempts for a signed webhook before it is dead lettered: 6
consent screen listing every scope before an install: 1
ways to ship: a development app on your own stores or a marketplace listing: 2
review before a version reaches merchants: 1

What an app is allowed to touch

The Autohisab Business (dev) developer platform lets you build an app once and run it inside a merchant's business. A publisher registers in the partner centre and creates an app; the app declares the scopes it needs, such as read:orders or read:customers, and the merchant sees that list on the install screen before granting it. Your server talks to a GraphQL API that answers only what those scopes allow, your screens open inside the admin on short-lived session tokens, and platform events such as order.created reach you as signed webhooks you can replay. While you build, a development app installs only on stores you own.

Scopes: Declared by the app, shown at install
Consent: Asked again when a version wants more scopes
Session tokens: Short-lived, for screens inside the admin
API tokens: For your server calling the API
Signing secret: Proves a webhook came from the platform
Versions: Reviewed before merchants receive them

Webhook deliveries

order.created 200
order.paid 200
cms.entry.published replayed

Signed with your app's secret. Any delivery can be replayed from the log.

Common queries

Questions people ask

Something else?

Try it free on your own catalogue

Anything that works with a business's own data: an integration with another system, a screen that opens inside the admin, a block or section for the storefront, or a job that runs on a schedule. An app reads and writes through a GraphQL API, receives platform events as webhooks and keeps its secrets on the platform.
An app declares its scopes, such as read:orders, read:customers or read:content. Before anything is installed the merchant sees that list on the consent screen, and the API refuses anything outside it. A later version that asks for more scopes needs a fresh approval.
No. An app is installed into a business, and the tokens it receives act for that installation, inside the scopes that merchant approved. Screens inside the admin use short-lived session tokens that are exchanged and refreshed, and your server uses its own API token.
Subscribe to the platform events your app needs, such as order.created, order.paid or cms.entry.published. Some events also need a scope, such as read:content for content events. Deliveries are signed with your app's secret so you can check they came from the platform, and the delivery log lets you see what was sent and replay a delivery.
Yes. You ship an app in versions and submit a version for review before it reaches merchants in the marketplace. A development app skips review, because it installs only on stores its developer owns.
The developer documentation is public, and an API reference with Postman and OpenAPI exports is available to signed-in developers with access to it.

Your app works on the same records

The orders, stock and content your app reads are the ones the counter and the storefront use.