Skip to main content

​
Register an app

Create your app with a single authenticated request. Authentication uses your Vambe API key in the x-api-key header. 
curl --request POST 'https://api.vambe.me/api/ecommerce-app' \
  --header 'x-api-key: your_api_key_here' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "My Ecommerce X",
    "description": "Connects My Ecommerce X stores to Vambe.",
    "logo_url": "https://cdn.myecommerce.com/vambe/logo.png",
    "website_url": "https://myecommerce.com",
    "developer_name": "My Ecommerce X Inc.",
    "contact_email": "integrations@myecommerce.com",
    "contact_phone": "+56912345678",
    "oauth": {
      "authorize_url": "https://myecommerce.com/oauth/authorize",
      "token_url": "https://myecommerce.com/oauth/token",
      "client_id": "vambe-client-id",
      "client_secret": "vambe-client-secret",
      "scopes": ["read_orders", "read_products"],
      "account_info_url": "https://api.myecommerce.com/vambe/account"
    },
    "capabilities": {
      "inbound_events": ["order", "checkout", "fulfillment", "product"],
      "outbound": {
        "order_get": { "url": "https://api.myecommerce.com/vambe/orders" },
        "stock_get": { "url": "https://api.myecommerce.com/vambe/stock" },
        "checkout_create": { "url": "https://api.myecommerce.com/vambe/checkout" }
      }
    }
  }'
The response includes a signing_secret: 
{
  "id": "f1e2d3c4-…",
  "slug": "my-ecommerce-x",
  "status": "draft",
  "signing_secret": "9b1f…(64 hex chars)…",
  "...": "..."
}
The signing_secret is returned only on creation (and on rotation). Store it securely — you need it to sign every inbound webhook. You can rotate it later, but it is never shown again on read.

​
Fields

​
Metadata

​
name
string
required
Display name shown to merchants.
​
slug
string
Stable identifier. Auto-derived from name if omitted; must be unique.
​
description
string
required
Short description shown in the connect UI.
​
logo_url
string (https)
required
Public URL of your app logo.
​
website_url
string (https)
Your marketing/site URL.

​
Contact (required)

The Vambe team uses these to reach you during review and operations.
​
developer_name
string
required
Your company/organization name.
​
contact_email
string
required
Contact email.
​
contact_phone
string
required
Contact phone number.

​
OAuth

See OAuth Connection for the full flow.
​
oauth.authorize_url
string (https)
required
Where Vambe redirects the merchant to approve scopes.
​
oauth.token_url
string (https)
required
Where Vambe exchanges the authorization code for tokens.
​
oauth.client_id
string
required
The client id you issued for Vambe.
​
oauth.client_secret
string
required
The client secret you issued for Vambe. Stored encrypted at rest.
​
oauth.scopes
string[]
Scopes requested during authorization.
​
oauth.account_info_url
string (https)
Optional. Lets Vambe fetch the store identity after connection — required for multi-store apps.

​
Capabilities

​
capabilities.inbound_events
string[]
Which canonical events you commit to pushing: any of order, checkout, fulfillment, product. See Inbound Webhooks.
​
capabilities.outbound
object
URLs Vambe calls on demand. Each entry is { "url": "https://..." }. Supported keys: order_get, stock_get, checkout_create. If you omit a key, Vambe simply won’t offer that assistant tool for your app. See Outbound Capabilities.

​
Manage and submit

1

Iterate (draft)

Update the app while it is draft or rejected:
curl --request PATCH 'https://api.vambe.me/api/ecommerce-app/{id}' \
  --header 'x-api-key: your_api_key_here' \
  --header 'Content-Type: application/json' \
  --data '{ "description": "Updated copy" }'
2

Submit for review

curl --request POST 'https://api.vambe.me/api/ecommerce-app/{id}/submit' \
  --header 'x-api-key: your_api_key_here'
This moves the app to pending_review and notifies the Vambe team.
3

Get approved

Once Vambe approves it, the app becomes approved and is installable by any account. Until then it is visible only to your account.

​
Other endpoints

MethodPathPurpose
GET/api/ecommerce-appList your apps.
GET/api/ecommerce-app/{id}App detail (no secret).
POST/api/ecommerce-app/{id}/rotate-secretGenerate a new signing secret.
DELETE/api/ecommerce-app/{id}Delete the app.
GET/api/ecommerce-app/availableApps installable by the current account.
Editing an approved app is blocked — only draft/rejected apps are editable. Editing a rejected app moves it back to draft so you can resubmit.