Developers — StoreBridge

Authentication

Plugin download: public, no authentication — always the current build, with a SHA-256 checksum.

Orders & WooCommerce OAuth: a Sellfee Seller Access Token (Bearer) — issued from the seller panel under System → API Access Tokens; valid for one year and revocable instantly.

Webhook ingest (WooCommerce & SDK): no token required, but every request is verified with an HMAC-SHA256 signature over the raw body using that site's own secret.

Real-time events (SSE): a StoreBridge-specific API key (sb_...) sent as a Bearer token, plus an Origin check.

Endpoint groups

GET /api/v1/storebridge/plugin/woocommerce — public — current plugin build metadata.

GET /api/v1/storebridge/plugin/woocommerce/download — public — downloads the plugin zip.

GET /api/v1/sites/{siteId}/orders — Seller Access Token — lists orders synced from the external store.

GET /api/v1/sites/{siteId}/orders/{orderId} — Seller Access Token — order detail, including refunds.

POST /api/v1/sites/{siteId}/orders/{orderId}/cancel — Seller Access Token — requests order cancellation.

GET|POST /api/v1/oauth/woocommerce/connect|callback|refresh — Seller Access Token — the WooCommerce REST API key connection flow.

POST /api/v1/webhooks/woocommerce/{siteId} — HMAC signature — native WooCommerce product/order events.

POST /api/v1/webhooks/sdk/{siteId} — HMAC signature — events from the embedded JS SDK.

GET /api/v1/sites/{siteId}/events — StoreBridge API key (sb_...) — real-time event stream for a connected storefront.

OpenAPI specification

A machine-readable version of this table is published at /openapi/storebridge.json, including request/response schemas and security schemes for every route.

Known limitation

Product sync is inbound-only today (WooCommerce → Sellfee); edits made inside Sellfee don't yet flow back out. Process refunds from Sellfee's Orders page so both sides stay consistent.