From a key to an answer
A new key, one question to learn its store, and your products read back by your own server.
Node.js
Every route as a typed method, with safe retries, pages and webhook checks:
npm install @shoplygg/node.PHP
The same for PHP 8.1 or later, with array shapes your editor reads:
composer require shoplygg/shoply-php.Python
The same for Python 3.9 or later, with types mypy reads:
pip install shoply.What it is for
Keep a catalogue in step
Push products, prices and license keys from wherever you already keep them, and pull stock counts back.
Act on orders
Read orders as they are paid, mark one paid yourself, deliver one again, refund one.
Sell from a bot
Raise an invoice for a buyer and hand them the page to pay it on, from Discord or anywhere else.
Feed your own tools
Send orders, customers, expenses and profit to accounting, a CRM or a spreadsheet.
How it is shaped
Every route but one is under/stores/{storeId}. Nothing here is an account’s: a product, an order, a customer is one store’s. A key is one store’s too, and reaches no other.
An answer has one shape, a success and a refusal alike. A key carries permissions, and each route’s page says which one it needs. Requests are counted for each key, and every answer says how much of its budget is left.
Authentication
Keys, the header they go in, and what protects one.
Permissions
Everything a key can be allowed to do.
Conventions
The envelope, lists, dates, money and how a save works.
Errors
What a refusal looks like and what each code means.
What it is not for
A browser. A secret key in a page is readable by every visitor of that page, so the API sends no CORS headers and a browser refuses to read its answers. For a storefront of your own, use the Storefront SDK, the embed or the Checkout Kit: they need a store ID and no key. A few things are also left to a person in the dashboard, where it asks them to confirm it is them: a payment method’s credentials, the dynamic delivery signing secret, where the store’s alerts are sent, and API keys themselves. A key that tries one is refused withdashboard_only.