Getting Started
Quickstart
Create a SaaS app, connect a test store, call the API and subscribe to events.
Build your first SaaS integration in seven steps. You need an approved Developer Account and a server-side application that can keep secrets and tokens out of the browser.
1. Create your developer app
Open Developer Dashboard → Apps → Create App. Enter the bilingual app name, stable slug, category and pricing model.
Expected result: the app appears in Your apps with status draft. Its App ID is also its OAuth client_id. Save the one-time Client Secret on your server.
2. Configure OAuth and your redirect URL
Open the app, create version 1.0.0, and register the exact HTTPS callback handled by your backend, for example https://app.example.com/oauth/callback. Loopback HTTP is accepted only for local development.
Your backend starts authorization at:
GET https://getsas.xyz/api/oauth/authorizeUse response_type=code, a fresh state, and PKCE S256. See OAuth 2.0.
3. Select the smallest required scopes
In the version wizard, select only what the app uses. For a product sync that only reads products, select catalog:read. For order reads, add orders:read. Webhook subscription management requires webhooks:manage.
Expected result: the exact requested scopes appear in the merchant consent screen. A missing scope returns 403; it never grants partial access silently.
4. Install on an authorized test store
Submit and publish the test version in an authorized local/test environment. Open its install URL, sign in as the test merchant, select the synthetic store and approve the scopes.
Expected result: SaaS returns one authorization code to your exact callback with the original state. Exchange it once from your backend. A public hosted Sandbox is not currently offered; never use real customer data as a substitute.
5. Call your first API endpoint
Send the access token from your backend. Start with products:
curl --request GET \
'https://getsas.xyz/api/v1/catalog/products?limit=10' \
--header 'Authorization: Bearer <ACCESS_TOKEN>'Expected result: 200 OK with data and pagination metadata. 401 means the token is missing, expired or revoked. 403 means the installation lacks the required scope.
6. Subscribe to Webhooks
Call POST /api/v1/webhooks with webhooks:manage, an event declared by the reviewed version, and your public HTTPS endpoint. Store the returned signing secret immediately; it is shown once.
Verify X-Saas-Signature against the exact raw body, reject stale timestamps, and deduplicate X-Saas-Event-Id. See Webhooks.
7. Submit for review and go live
Complete Marketplace information, screenshots, support and privacy URLs. In Apps, choose Submit for review. Resolve any review note, publish the approved version, then have each production merchant complete OAuth consent.
Before going live, confirm redirect matching, state and PKCE validation, missing-scope denial, token refresh rotation, webhook signatures, idempotency, uninstall and revocation.