Shopify, Amazon & TikTok Shop

Shopify

Connect your Shopify store to bring product data into your campaigns and turn fulfilled orders into loyalty points — no code, just a store domain and an Admin API access token.

// What the platform exposes for the Online Shop connection:
POST /api/shopify/connect      { "shopDomain": "my-store.myshopify.com", "accessToken": "shpat_…" }
GET  /api/shopify/status       // → { connected, shopDomain, status, lastSyncedAt, productCount, apiVersion }
POST /api/shopify/sync         // pull products now
POST /api/shopify/disconnect   // remove the connection + synced product data
//
// Orders: SocialHub receives Shopify order webhooks (order.fulfilled) and awards points
// keyed by the order id — idempotent, so a replayed webhook never double-awards.
// Connecting an Online Shop requires the Omnichannel plan.

TikTok Shop

Same verify-don't-trust model as Amazon, against the TikTok Shop Partner API. You authorize a TikTok Shop Partner app on your shop to get an App Key / App Secret and a refresh token. Set it up under Settings → Online Shop → TikTok Shop(team admins & system admins).

Connection settings

Secrets (encrypted at rest · write-only)

Leave Shop Cipher blank — Save & Verify discovers it from your authorized shop. TikTok rotates the refresh token on every refresh; the platform serializes and persists the rotation so concurrent jobs never invalidate each other.

// Marketplace credentials (Amazon / TikTok Shop) are saved + liveness-checked here.
// Open to team admins (org_owner / org_admin) and system admins; tenant-isolated —
// an admin can only ever read/write their OWN team's channels.
POST /api/admin/channels            { teamId, kind: "amazon" | "tiktok", name, config, secrets }
POST /api/admin/channels/{id}/ping  // re-verify the connection (discovers shop refs / cipher)
//
// Secrets (refresh_token, client_secret, app_secret, …) are AES-GCM encrypted the
// instant they arrive — write-only, never returned, never logged.