Skip to content
↑↓ navigate↵ openEsc close
Bahasa IndonesiaEnglish

Resources

Changelog

Changes to the public API and webhooks.

Separate Developer Console; OAuth apps belong to developer workspaces

  • Apps, sandbox API keys, and sandbox webhooks are managed in the Developer Console (/console on the developer site). One TheComNet login can own a business and separate developer workspaces.
  • POST /v1/developer/apps and POST /v1/developer/apps/{id}/submit from a merchant workspace return 403 DEVELOPER_ACCOUNT_REQUIRED.
  • Sellers manage API keys, webhooks, and installed apps under Pengaturan → Integrasi.
  • Developer workspaces reach the API only through OAuth apps: API keys and manual webhook endpoints answer 403 DEVELOPER_ACCOUNT_RESTRICTED. New: POST /v1/developer/apps/{id}/test-token installs the app in the sandbox and issues tokens without the redirect flow.

Developer accounts with sample data, sandbox mode for unpublished apps, simulated webhook events

  • Free developer accounts seeded with a sample store, products, stock, orders, contacts, and chat. Store, plan, and billing operations answer 403 DEVELOPER_ACCOUNT_RESTRICTED. See Sandbox & developer accounts.
  • Sandbox mode for developer accounts and for unpublished apps in their own tenant: no Pro needed, 60 requests per minute, token-info reports sandbox: true.
  • POST /v1/developer/sandbox/events sends a sample event with simulated: true to subscribed endpoints.

Third-party apps: OAuth 2.0 authorization code with PKCE, rotating refresh tokens, app webhooks

  • Register apps under Developer Console → Aplikasi (tcn_app_… / tcn_cs_…), submit for review, and publish to every tenant. See Build an app (OAuth 2.0).
  • POST /v1/oauth/token issues 1-hour access tokens (tcn_at_…) and 90-day refresh tokens (tcn_rt_…) that rotate on use; POST /v1/oauth/revoke follows RFC 7009.
  • App tokens use the API key endpoints and scopes, limited to 600 requests per minute per installation. token-info reports kind: "app".
  • App webhooks: one URL and secret per app, an endpoint per installation.

Public API v1: API keys, scopes, webhooks

  • API keys (tcn_live_…) for Pro tenants, created under Pengaturan → Developer. See Authentication.
  • Eight scopes across orders, products, contacts, and chat; operations opt in per scope. See the API reference.
  • 600 requests per minute per key with x-ratelimit-* headers.
  • Signed webhooks for orders, after-sales, stock, and chat. See Webhooks.