Build on Nouq.Reach every store.

1. 1

   Register your app

   In the developer portal: name, redirect URIs and scopes. You get a client_id and a client_secret (shown once).

   client_id      Xk7pQ2…  (24 characters)client_secret  nouq_cs_…

2. 2

   Send the merchant to consent

   They see your app and every permission it asks for, then come back to your redirect URI with a code. Use state against request forgery.

   https://app.nouq.net/oauth/authorize  ?client_id=YOUR_CLIENT_ID  &redirect_uri=https://yourapp.com/callback  &scope=orders:read products:write  &state=RANDOM_STATE

3. 3

   Exchange the code for a token

   From your server, within ten minutes. A token belongs to one store, doesn't expire, and stops working when the merchant removes your app.

   curl https://api.nouq.net/oauth/v1/token \  -d grant_type=authorization_code \  -d code=$CODE -d redirect_uri=$REDIRECT_URI \  -d client_id=$CLIENT_ID -d client_secret=$CLIENT_SECRET { "access_token": "nouq_at_…", "scope": "orders:read products:write", "store_id": "…" }

4. 4

   Read, and listen

   Call the API with the token and subscribe to events. Verify every delivery's signature before you trust it.

   curl https://api.nouq.net/api/v1/orders?status=confirmed \  -H "Authorization: Bearer nouq_at_…" // Nouq-Signature: t=…,v1=…const { t, v1 } = Object.fromEntries(  req.headers["nouq-signature"].split(",").map((p) => p.split("=")));const want = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");const ok = Math.abs(Date.now() / 1000 - Number(t)) < 300  && timingSafeEqual(Buffer.from(want), Buffer.from(v1));

Everything else is in the reference