Register your app
1
Open the Developer console
In your Salesive store dashboard, go to Apps → Developer and choose Create app.
2
Fill in the basics
Give your app a name, tagline, description, icon, and category. Add at least one
redirect URI (the callback URL your server handles after consent) and select the
scopes your app needs.
3
Save your credentials
On creation you receive a
client_id and a client_secret. The secret is shown only
once — store it securely. You can regenerate it later if needed.4
Set your launch URL
Set the Install / launch URL (
appUrl) to where a merchant lands after installing: your
app’s own page or dashboard. The marketplace Install button opens the Salesive consent
screen, not this URL. See How an install starts.5
Add a webhook URL (optional)
Set a Webhook URL to receive real-time, signed events when store data your app can
access changes, with no polling. The URL must be HTTPS, must not contain credentials, and
must not resolve to localhost or a private address. The console also shows your signing
secret for verifying deliveries. You can narrow the feed with
webhookTopics; see
Webhooks.Get paid (optional)
If your app charges merchants, choose a payout store in the Developer console under Billing. It must be a store you own. Earnings are credited to its wallet, minus Salesive’s 5%. See Payments.Test your app before submitting
While your app is a draft, you can install it on your own store to test the full OAuth flow end to end. Run through the install flow, confirm your token exchange works, and verify your API calls succeed with the scopes you requested.Submit for review
When your app is ready, submit it for review from the Developer console (orPOST /apps/developer/:id/submit). Your app moves through this lifecycle:
1
Draft
Visible only to you. Editable and installable on your own store for testing.
2
Pending
Submitted and awaiting review by the Salesive team.
3
Approved
Published and discoverable in the Apps marketplace. Merchants can install it.
4
Rejected
Sent back with reviewer feedback. Address the feedback and resubmit.
Before submitting, declare at least one scope and make sure your listing (name, description,
icon, launch URL) is complete. Apps are only listed publicly once approved.
How merchants install your app
Once approved, your app appears in the Apps marketplace inside every merchant’s dashboard. A merchant opens your listing and clicks Install, which opens the Salesive consent screen for the store they picked. Nothing is installed until they approve it there. The marketplace button does not call your install URL. The dashboard asks the API for a short lived, single use consent ticket (POST /api/v1/apps/marketplace/:slug/install-consent), opens the
consent screen with it, and the approval step consumes the ticket and creates the installation. The
dashboard then follows the redirect_url from the approval step to your registered redirect URI,
so your callback receives the authorization code and your app can exchange it for tokens
immediately. An existing installation is reused. Your appUrl is where the merchant lands when
they open the app, not where the install starts. See
How an install starts.
You can still share a direct link from your own marketing site: point it at the authorization
endpoint with your client_id, redirect_uri, scopes and PKCE pair, or at your own install page
that builds that request. That path shows the same consent screen and creates the installation on
approval. The old direct install endpoint is gone.
Installed apps appear under Apps → Installed apps, where merchants can review the granted
permissions and uninstall at any time. If your app stores customer data, read
Data protection before you publish: Salesive sends mandatory erasure and
access notices to every installed app.
Ship changes safely
Your app’s delivery config is live the moment you save it: a new webhook URL, redirect URI, launch URL or extension changes what every install sees. Releases let you freeze that config, publish it on purpose, roll it out to a percentage of installs and roll it back. A release is an immutable snapshot, and production installs are pinned to the release they were assigned. See Releases.Security best practices
Keep the secret server-side
Never ship the
client_secret in client code. Complete the token exchange only from your
backend.Always use PKCE
Generate a fresh
code_verifier per install and verify state on the callback to prevent
CSRF.Request least privilege
Ask only for the scopes you use. Fewer permissions means higher merchant trust and approval.
Use exact redirect URIs
Register full, exact callback URLs. Salesive rejects redirects that don’t match.
Rotate refresh tokens
Refresh tokens rotate on use — persist the newest one and discard the old.
Handle uninstalls
Treat a
401 “no longer installed” as an uninstall: stop calling the API and purge stored
tokens for that store.Next steps
Review the install flow
The full OAuth 2.1 + PKCE handshake.
Browse scopes
Pick the right permissions for your app.
Protect customer data
Handle erasure and access notices within 30 days.
Release safely
Snapshot, publish and roll back your delivery config.