How an app fits in
Four nouns
Section titled “Four nouns”| Noun | What it is | Lives |
|---|---|---|
| App | Your software’s identity on the platform: a handle, a name, a client id and client secret. | Platform-wide |
| Installation | One app installed on one store, with the scopes that store granted it and a signing secret for webhooks. | Per store |
| Token | A bearer token (ciqra_at_…) that acts as one installation. It carries the store and the scopes. |
Per installation |
| Store | A merchant on CIQRA, reached by its own domain. | — |
A token is always issued to an installation — an (app, store) pair — never to “a store” or “an app” on its own. That is why every change your app makes shows up in the merchant’s records as made by your app, and why removing the app stops it immediately.
The store comes from the domain, never from a parameter
Section titled “The store comes from the domain, never from a parameter”You call the API on the store’s own domain: https://www.example-store.com/apps/catalog/products. The
platform resolves the store from the host name, and your token must belong to an installation on that same
store. There is no store id in the URL, no X-Tenant header for apps, and no way to reach store B with a
token issued on store A — the request is refused as if the token did not exist.
Use the store’s primary domain. Its *.myciqra.com address works for the token call but redirects other
requests to the primary domain.
How an app gets created and installed today
Section titled “How an app gets created and installed today”There is no public partner portal yet. An app is created in one of two ways:
- By the store itself — in the CIQRA admin under Settings → Apps, the merchant creates a private app, picks its permissions, and receives the client id, client secret and signing secret once. This is the normal path for an integration built for one store.
- By CIQRA — the operator console registers an app for a partner and installs it on a store with a chosen scope set. This is how first-party apps such as the Zugo sync are set up.
Either way you end up with the same three secrets:
| Secret | Prefix | Used for |
|---|---|---|
| Client id | ciqra_ci_ |
Identifying your app at the token endpoint |
| Client secret | ciqra_cs_ |
Proving it. Shown once; the platform stores only a hash. |
| Signing secret | ciqra_ss_ |
Verifying webhooks CIQRA sends you. Shown once. |
A merchant can also issue standing tokens (30–365 days) for an installation from the admin, for tools that cannot run a token exchange. Prefer the client-credentials exchange: its tokens live one hour.
What the merchant controls
Section titled “What the merchant controls”- Scopes. The merchant sees every permission your app asks for, in Turkish, and can change the set later. A scope removed takes effect on your next token.
- Removal. Uninstalling revokes every token of the installation at once and deactivates its webhook subscriptions. Content your app created (products it edited, images it imported) stays with the store.
- Suspension. CIQRA can suspend an app platform-wide; its tokens stop working on the next request. Nothing is cached, so revocation takes effect immediately.