Connect another platform
Connect a plugin or extension to GenFashion with a one-time code, so merchants never handle a long-lived key.
Use this if you are building a GenFashion plugin for a platform other than Shopify, such as a WordPress or nopCommerce extension. The merchant pastes a short one-time code into your plugin, and your plugin swaps it for keys.
A code works once and expires after 24 hours, so it is worth nothing once used. Merchants never have to copy a long-lived key.
How the exchange works#
- The merchant opens Settings > Integrations > Connect another platform in GenFashion and creates a code. It is shown once.
- They paste it into your plugin's settings.
- Your server redeems it straight away:
curl -X POST "https://genfashion.buildframe.tech/api/integrations/connect/redeem" \
-H "Content-Type: application/json" \
-d '{
"code": "GF-7QK2-M4XP-9DTW",
"siteUrl": "https://shop.example.com",
"storeName": "Acme Store"
}'Dashes and capitals in code do not matter, so do not reject a code for its punctuation.
{
"ok": true,
"publishableKey": "sk_publishable_example",
"secretKey": "sb_secret_example",
"apiBase": "https://genfashion.buildframe.tech/api/storefront/v1",
"widgetUrl": "https://genfashion.buildframe.tech/embed/v1.js",
"allowedOrigins": ["https://shop.example.com"],
"storeName": "Acme Store"
}siteUrl becomes the publishable key's allowed domain, so the merchant never has to type it.
Use the keys#
publishableKeyandwidgetUrl: add the storefront widget to product pages, withwidgetUrlas the script'ssrc.secretKey: use it from your server, for example to call the Try-On API. Store it on the server and never show it, including on your own settings screen.
The secret key cannot be retrieved again. If it is lost, the merchant creates a new code and reconnects.
Handle errors#
| Code | What to do |
|---|---|
INVALID_CODE | The code is unknown, used or expired. The reason is deliberately not given. Ask the merchant to create a new one |
SITE_URL_REQUIRED | siteUrl is missing or malformed. Fix the request |
Call this endpoint from your server. It sends no CORS headers, so a browser cannot call it.