The public API & SDK for building plugins
A curated, versioned REST surface at /v1, a rooted OAuth handshake at /oauth, and a typed scope catalog enforced on every endpoint.
API Reference
Live OpenAPI viewer. Browse every /v1 endpoint, its required scope, request shape and response — driven by the platform's published spec.
OAuth Scope Catalog
Every scope string a plugin can request, the naming convention, what each scope grants, and what is intentionally not in the catalog.
SDK — @orbitcommerce/sdk
TypeScript SDK with OrbitClient, products / orders / customers / settings clients, billing helpers and the full OAuth token lifecycle.
Plugin guides
Build-and-publish walkthroughs: getting started, the OAuth flow, scopes, the SDK, webhooks, and shipping to the marketplace.
From zero to your first API call
The SDK wraps authentication, the x-store-id header and pagination, so a plugin can read the catalogue in a few lines.
- 1
Register as a partner
Create a partner account and your plugin in the Partner Dashboard to obtain credentials.
- 2
Complete the OAuth handshake
A merchant installs your plugin and consents to scopes; you exchange the grant at /oauth for a plugin access token.
- 3
Call /v1 with your token
Send the Bearer token plus the x-store-id header — or let the SDK do it — and you're reading live data.
npm install @orbitcommerce/sdkimport { OrbitClient } from '@orbitcommerce/sdk';
// Embedded in a merchant's dashboard: the SDK receives that store's
// token + storeId over postMessage — nothing is hard-coded per store.
const orbit = new OrbitClient();
await orbit.ready();
// Read the catalogue the merchant granted you access to
const { items } = await orbit.products.list({ limit: 20 });The shape of the platform
- Base URL
- https://api.myorbitcommerce.net
- Data API
- /v1/*
- Token handshake
- /oauth/*
- Auth
- Bearer token + x-store-id
versioned · rooted
unversioned · stable across data-API versions
scoped per merchant install
Ready to build?
Spin up a partner account, install the SDK, and ship your first integration against the live API.