Apps published in the IdoSell Apps, in addition to properly handling the connection with API Admin IdoSell have an additional mechanism to automate the switching on and off of the app in the merchant panel.

We divide apps into two types:

• online - installed and run on the developer's server
• downloadable - downloaded by the user and run on his/her own device

Turning on the application

Regardless of the type of application, each time a license is turned on and off, the system sends a webhook to the developer to inform him of the event.

Example of a webhook for a “downloadable” application

Request:
POST: url_webhook_new_license
{
    client_id: (int) //client id
    application_id: (int) // application id
    api_url: (string) //address to api admin
    api_license: (string) // license number
    sign: (string) // communication signature
    contact_data: { // optional when the contact form is enabled
      name: (string)
      email: (string)
      phone: (string)
      
     }
}

Webhook example for “online” application

Request:
POST: url_webhook_new_license
{
    client_id: (int) //client id
    application_id: (int) // application id
    api_url: (string) //address to api admin
    api_key: (string) // access key
    api_license: (string) //license number
    authorization_type: (string) // authorization type (enum: “key”, “OAuth”)
    sign: (string) // communication signature
    contact_data: { // optional when the contact form is enabled
      name: (string)
      email: (string)
      phone: (string)
    },
    selected_shops: [ // optional when the shop to integrate list is enabled
    { 
      id: (int) // shop id
      name: (string) // shop URL 
      }...
    ]
}

In both cases, we expect the answer to be:

Response:  
{  
    status: ok | error // status  
    sign: (string) // communication signature  
}

Note: The parameter “api_key”

The 'api_key' parameter is encrypted, and in order to use it to communicate with the API, it must be decrypted. The algorithm used to encrypt the key is “AES-256-CBC”, the developer's unique key is used as the encryption key. The encryption vector can be changed and its current form can be found at: <https://apps.idosell.com/keyset>
Example of PHP code, decrypting the API access key

$iv = trim(@file_get_contents(‘https://apps.idosell.com/keyset’));
if ($iv) {
    $key = openssl_decrypt(
        base64_decode($key),
        ‘AES-256-CBC’,
        $applicationKey,
        0,
        $iv
    );
}

If you are using a language other than PHP, such as JavaScript or Python, and you are experiencing issues with the key, try the following solution:

"key = Base64.decode64(Base64.decode64(authorization_token))"

Installation of online applications

For “online” applications, sending a webhook with the inclusion of a new license is the same as accepting a request to start the process of installing an application instance for a given merchant. Since, depending on the system, this process can vary significantly between applications, we do not require an immediate response to this webhook.
When the online application installation is complete, notify IdoSell Apps that the process is complete by sending a webhook with information about the license and the application to which the installation applies.

Request:
POST: https://apps.idosell.com/api/application/installation/done
{
    api_license: (string) //license number
    application_id: (int) // application id
    developer: (string) // developer login
    sign: (string) // communication signature
}

Response:
{
    status: ok | error // status  
    sign: (string) // communication signature  
}

When the information about the correct installation is received, the information is passed to the merchant, the trial period begins and the application is made visible in the menu of the administration panel (for “online iframe” applications).

Turning off the application

Regardless of the type of application, the merchant can choose to disable the application at any time. (For more information on this, see Enabling and disabling applications).
When the application is shut down, a webhook is sent to the developer to take appropriate action on the application side

Request:
POST: url_webhook_remove_license
{
    client_id: (int) //client id
    application_id: (int) // application id
    api_url: (string) //address to api admin
    api_license: (string) // license number
    sign: (string) // communication signature
}

Response:
{
    status: ok | error // status  
    sign: (string) // communication signature  
}

Launching online application in merchant panel

Some “online” applications have their own interface to be presented in the merchant panel. Such an application is visible in the indicated menu node. In order to launch it, it is advisable to implement an autologin link along with a one-time token, with the help of which authentication is performed.
In order to correctly handle this scenario, when the application is launched, the merchant panel sends a webhook requesting the generation of an address along with the token to which the user is to be redirected.

Request:
POST: url_aplikacji
{
    client_id: (int) //client id
    application_id: (int) // application id
    api_url: (string) //address to api admin
    api_license: (string) // license number
    sign: (string) // communication signature
}

Response:
{
    status: ok | error // status
    redirect: (string) // url to redirect to
    sign: (string) // communication signature
}

After receiving the redirect parameter, the site launches the indicated url, which should already be a page with a logged-in user.

Generating the $sign parameter

In order to sign the communication, you need to generate the $sign parameter, which consists of the IdoSell Apps developer's ID (login), the date in the format YYYY-MM-DD, and the unique application key, which is assigned when the application is added in the IdoSell Apps panel.

$sign = hash(‘sha256’, $login  . ‘|’ . date(‘Y-m-d’) .  ‘|’ . $applicationKey);