Rules

App platform rules

Apps that integrate with Sellify stores must follow these rules. Violations can lead to tokens being revoked.

Least privilege. Request only the scopes your features need. Don't request write scopes for read-only features.
Protect credentials. Keep access tokens and webhook secrets on your server, encrypted at rest. Never ship them to browsers or apps. Rotate on any suspected leak.
Verify every webhook with the HMAC signature before trusting it, and deduplicate with X-Sellify-Webhook-Id.
Respect rate limits. Read extensions.cost, back off on 429 using Retry-After, and paginate large syncs instead of polling.
Be idempotent. Webhooks can arrive more than once and out of order; fetch the latest state with the API when ordering matters.
Customer data. Use shopper personal data (names, phones, addresses) only to provide your app's service to the merchant, comply with India's DPDP Act 2023, and delete it when the app is uninstalled or on request.
Payments. Apps must not collect card/UPI details or redirect checkout payments. Payments run through the merchant's connected gateway (Razorpay) or COD only.
Storefront code. Theme code and pixels must not degrade performance (load scripts async), must not inject deceptive UI, and must not track shoppers without the merchant's consent setup.
Pin an API version and upgrade within the support window. Handle unknown enum values and new fields gracefully.
Support. Provide the merchant a contact for your app and a way to uninstall cleanly (revoke the token in Apps → Develop apps).