BunStackDocs
Contents

For developers

For developers

What a developer can build against BunStack: API, webhooks, product feeds and own code in the storefront, with links to the references.

Last updated · 2 min read

The pages here are for people who build against BunStack or write their own code in a storefront.

Where: Settings › Developer. It has API keys, Webhooks, API docs and Developer tools.

Developer tools shows read-only diagnostics: the session's JWT claims, the workspace's settings and the modules' state. The row shows only for owner and admin.

You want toUsePage
Read products, orders, customers and reviewsThe API with an API keyWebhooks and API keys
Create and change products, set order statusThe API with a write:… scopeOperations
Know when an order is paid, shipped, refunded or cancelledWebhooksWebhooks
Send the catalogue to Google or MetaThe product feedProduct feeds
Change HTML, CSS or JS for a componentThe code editor in the designerYour own code on a component
Look up variables, actions and hooks in the templatesThe template referenceTemplate reference
Add analytics or tracking code to the storefrontHEAD · SITE in the designerYour own CSS and head code

The API in short

  • One address. Every call is a POST with a JSON body that names op.
  • Send the key as Authorization: Bearer bunstack_….
  • The address and every request body are under Settings › Developer › API keys › View docs.
  • A key may make 600 calls per minute, of which at most 60 writes.
  • The API cannot cancel, refund or hand over a pickup order. Do it in the admin.

Webhooks in short

  • BunStack sends a POST with JSON to your https address.
  • The body is signed with HMAC-SHA256. Check the signature before you trust the content.
  • Delivery is at least once. Deduplicate on delivery_id.
  • BunStack tries again 4 times: after 1, 5, 15 and 60 minutes.

Your own code in the storefront

  • The templates are HTML with variables in double curly braces. No code runs in the template.
  • Handle clicks with data-bs-action on the element, not with event handlers of your own.
  • CSS is scoped to the component's root. JS runs once per page load with the root as root.
  • External scripts in <head> run only from a list of allowed hosts and only after cookie consent.

Limits, sanitising rules and a complete example are in the Template reference.