Apps & API
Connect anything, with permissions you can read
Install apps from the SellOrchard app store after reviewing exactly what each one can see and change. When you need something custom, create an API key with only the scopes it needs, or subscribe an endpoint to the events your systems care about.
- Same API for your own scripts and for published apps
- OpenAPI 3.1 reference at sellorchard.com/docs/api
- Keys and secrets shown once, then stored hashed
Availability: App store on every plan — OAuth apps, API keys and webhooks on Pro and Advanced (test mode in the free trial)
REST API v1
A stable API with the boring parts done properly
The v1 API lives at api.sellorchard.com/v1 and speaks JSON with ISO-8601 UTC times and money as decimal strings with a currency. Lists use cursor pagination, POST requests accept an Idempotency-Key so a retry never creates a second order, and every response carries rate-limit headers.
Errors share one shape with a type, a message and the offending parameter. Writes made through the API show up in your activity log and fire the same emails and webhooks as changes made in the admin.
- Products, variants, categories, brands and inventory by location
- Orders, fulfilments, cancellations, refunds and notes
- Customers, discount codes, gift cards, bookings, purchase orders and sales reports
- 120 requests per minute per key (30 in the trial)
Installing an app
Four clear steps, nothing hidden
Step 1: Find it
Browse the app store by category — marketing, sales, shipping, inventory, accounting, customer service, analytics, design or productivity — and read reviews from other stores.
Step 2: Review the permissions
The consent screen lists what the app can read and write in plain English, with optional permissions you can switch off.
Step 3: Approve
SellOrchard sends the app a one-time code it exchanges for its own access token, limited to the permissions you granted.
Step 4: Use it, or remove it
Embedded apps open inside your admin. Uninstalling revokes the token immediately and removes its webhooks.
Webhooks
Events delivered, verified and retried
20 topics
Orders created, updated, paid, fulfilled, cancelled and refunded; products, inventory, customers, bookings, refunds, returns, discounts and gift cards.
Signed payloads
Each delivery carries a timestamp and an HMAC-SHA256 signature of the body using your endpoint's secret.
Retries with backoff
Failed deliveries are retried after 1, 5 and 30 minutes, then 2, 6, 12 and 24 hours — eight attempts in all, spread over almost two days.
Delivery log
Every attempt with its status code, response and duration, kept for 30 days. Resend any delivery or send a test event.
Self-protecting
An endpoint that fails continuously for three days is switched off and the store owner is emailed.
In detail
Everything for apps and developers
34capabilities in 6 areas
API keys
5- Named keys with chosen scopes and optional expiry
- Prefixes so_live_ and so_test_ (trial stores)
- Secret shown once; roll or revoke any time
- Last used time and IP for each key
- Request log kept for 14 days
Scopes
3- Read and write: products, inventory, orders, customers, discounts, gift cards, bookings
- Read only: reports and store details
- Write scopes include read access
API conventions
7- Versioned base URL /v1
- Cursor pagination up to 250 items per page
- updated_since and created_since filters
- Idempotency-Key on POST, remembered for 24 hours
- X-RateLimit headers and Retry-After on 429
- One consistent error format
- OpenAPI 3.1 spec at /v1/openapi.json
Webhooks
6- HTTPS endpoints with chosen topics and a description
- Signing secret shown once; roll any time
- HMAC-SHA256 signature with a timestamp
- 8 delivery attempts spread over almost two days
- Resend, test events and a 30-day delivery log
- Automatic disable after 3 days of failures, with an email
App store
7- Categories, search, ratings and reviews
- Plain-language consent screen with optional permissions
- OAuth authorization-code install with signed redirects
- Embedded apps in your admin with short-lived session tokens
- "Update permissions" prompt when an app asks for more
- Uninstall revokes access and notifies the app
- Built-in listings for ShipStation, Google & Meta channels and Printful & Printify
For app developers
6- Developer portal for any SellOrchard account
- Listing editor with icon, screenshots, pricing text and links
- Redirect URLs, webhook URL and requested scopes
- Test installs on your own stores before review
- Every app reviewed before it's listed
- Unlisted apps installable by direct link for private use
On Pro and Advanced — try it free in test mode
API keys, webhooks and installing OAuth apps are part of the Pro and Advanced plans. During the free trial you get test keys (so_test_) with a lower rate limit, so you can build and test an integration before choosing a plan.
Which plans include the API?
Pro and Advanced. The free trial includes the API in test mode with so_test_ keys and a limit of 30 requests per minute.
How do I verify a webhook really came from SellOrchard?
Each delivery includes a timestamp and a signature: an HMAC-SHA256 of the timestamp and raw body using your endpoint's secret. Recompute it and compare. The docs include examples in Node, PHP and Python.
What happens if my endpoint is down?
A failed delivery is retried with growing gaps — up to eight attempts over almost two days. You can resend any delivery from the log, and an endpoint that fails continuously for three days is switched off with an email to the store owner.
Can an app see everything in my store?
No. An app only gets the permissions shown on the consent screen and approved by you. Optional permissions can be switched off, and uninstalling revokes its access immediately.
Is there an API reference?
Yes, at sellorchard.com/docs/api, generated from the OpenAPI 3.1 spec, with example requests and responses and guides to authentication, pagination, errors, rate limits, idempotency and webhook signatures.
Can I build an app for other merchants?
Yes. Register in the developer portal, create a listing, test it on your own stores and submit it for review. Approved apps appear in the app store.
Build on SellOrchard
Start a free trial, create a test API key and receive your first webhook in a few minutes.
No credit card needed to start.