Creating an App

{
  "name": "Order Tracker Pro",
  "slug": "order-tracker-pro",
  "description": "Track all your orders in real-time with live status updates and customer notifications.",
  "short_description": "Real-time order tracking and notifications",
  "icon": "https://cdn.example.com/tracker-icon.png",
  "screenshots": [
    "https://cdn.example.com/tracker-dashboard.png",
    "https://cdn.example.com/tracker-settings.png"
  ],
  "homepage_url": "https://tracker.example.com",
  "app_url": "https://tracker.example.com/embed",
  "webhook_url": "https://api.tracker.example.com/api/oauth",
  "webhook_receive_url": "https://api.tracker.example.com/api/webhooks",
  "redirect_urls": ["https://tracker.example.com/oauth/callback"],
  "requested_scopes": [
    "read:orders",
    "read:customers",
    "read:shipping",
    "billing"
  ],
  "webhook_topics": ["order.created", "order.status_changed"],
  "developer_name": "Acme Dev Co",
  "developer_email": "[email protected]",
  "pricing_type": "subscription",
  "pricing_amount": 499,
  "commission_rate": 0.2,
  "category": "order-management"
}

const express = require("express");
const app = express();
 
const CLIENT_ID = process.env.SELORAX_CLIENT_ID;
const CLIENT_SECRET = process.env.SELORAX_CLIENT_SECRET;
 
app.get("/oauth/callback", async (req, res) => {
  const { code, state } = req.query;
 
  // 1. Verify state matches what you sent (CSRF protection)
  if (state !== req.session.oauthState) {
    return res.status(400).send("Invalid state parameter");
  }
 
  // 2. Exchange the authorization code for tokens
  const response = await fetch("https://api.selorax.io/api/apps/oauth/token", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      grant_type: "authorization_code",
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code,
      redirect_uri: "https://your-app.com/oauth/callback",
    }),
  });
 
  const tokens = await response.json();
 
  // 3. Store tokens securely, keyed by store_id
  await db.saveInstallation({
    store_id: tokens.store_id,
    store_name: tokens.store_name,
    installation_id: tokens.installation_id,
    access_token: tokens.access_token, // encrypt this
    refresh_token: tokens.refresh_token, // encrypt this
    scope: tokens.scope,
    token_expires_at: new Date(Date.now() + tokens.expires_in * 1000),
  });
 
  res.redirect("/install-success");
});

import requests
from flask import Flask, request, redirect, session
 
app = Flask(__name__)
 
@app.route("/oauth/callback")
def oauth_callback():
    code = request.args.get("code")
    state = request.args.get("state")
 
    if state != session.get("oauth_state"):
        return "Invalid state", 400
 
    response = requests.post(
        "https://api.selorax.io/api/apps/oauth/token",
        json={
            "grant_type": "authorization_code",
            "client_id": CLIENT_ID,
            "client_secret": CLIENT_SECRET,
            "code": code,
            "redirect_uri": "https://your-app.com/oauth/callback",
        },
    )
 
    tokens = response.json()
    # Store tokens.access_token, tokens.refresh_token, tokens.store_id
    save_installation(tokens)
    return redirect("/install-success")