TRTürkçeENEnglish
Open your store

Build apps for Milofly.

Your app connects to stores through a documented API, permissions approved one by one and signed webhooks. Before installing, merchants see which data your app can reach, and your app opens inside their admin.

Go to the developer portal Read the docs

Open your developer account yourself with your email or your Google account. The docs can be read without signing in.

App installWhat the merchant sees
Your appis asking for
  • Read orders
  • Customer name and email
  • Write stock for its own products
  • Receive order webhooks
New permissions need a fresh approval.
The permission screen at install. Simplified view with sample data.

Join for free, build apps and sell to stores.

You pay Milofly nothing for your developer account, the docs, test stores or publishing. Merchants install apps on every plan, and paid apps sell at the price you set.

  1. Join for free

    The developer account, the docs and the test store cost nothing. Section settings, content sources and pop-up types are documented in the portal too.

  2. Build apps

    A free developer account, a documented App API, signed webhooks and a free test store. After review your app is listed in every merchant's app store.

  3. Sell to stores

    Merchants install your app on any plan. You set pricing plans for your app and see charges and your share on the earnings screen in the portal.

Everything an app needs is ready.

We build our own apps with the same tools. There is no separate or cut-down path for you.

  • A documented app API

    Reach product, category, price, stock, warehouse, order, fulfilment, customer, coupon, invoice and shipment data through documented endpoints. Every response states its warnings clearly, and partial success in bulk operations is never hidden.

  • Permissions approved one by one

    Reading orders and seeing the customer's name and address, writing stock and writing invoice results, are separate permissions. Your app only reaches the data it asked for and the merchant approved.

  • Install with OAuth

    At install, merchants see and approve the permissions your app asks for. When you ask for a new permission, approval is asked again, and when the app is removed its access ends.

  • Signed webhooks

    Order, payment, shipping, cancellation and refund events reach you as webhooks signed with HMAC-SHA256. Deliveries that fail are retried, and you can follow deliveries in the portal.

  • Apps that open inside the admin

    Your app opens inside the merchant's admin, not in a separate tab. The merchant's identity arrives in a short-lived token signed by the server, and the admin refreshes it when it expires.

  • Sections on order, customer and product pages

    Add your own sections to order, customer and product detail pages, so merchants use your app without leaving their work.

  • Free test stores

    Open a real test store and try the install and permission screen end to end, exactly as merchants will see them. Test stores carry no subscription fee.

  • Connect as a provider

    Connect as a carrier, an e-invoice provider or an analytics tool without touching the core. The provider record is set up together with Milofly, and merchants approve it separately.

  • Publish in the app store

    After review, your public app is listed in the app store in every merchant's admin. Choose the countries it can be installed in, reply to reviews and follow your installs region by region.

  • Custom apps for your own stores

    An app you only use in your own stores stays out of the catalogue and installs without review.

  • Section and content contract

    Storefront section settings, content sources and pop-up types are documented in the portal.

  • A developer portal in five languages

    API docs, the event list and the capability catalogue are in the developer portal, which works in Turkish, English, German, French and Arabic.

From sign-up to launch in four steps.

  1. 1

    Register your app

    Register your app in the developer portal through the identity, technical settings, listing and summary steps. The client ID and secrets are shown only once and can be rotated whenever you like.

  2. 2

    Try it in a test store

    Open a free test store and see the install, permission screen and webhooks in a real store. Send a signed test event from the portal and follow its delivery.

  3. 3

    The merchant approves

    The merchant sees the permissions and approves them. Your app exchanges the one-time code for an access token and starts calling the API.

  4. 4

    Publish

    If it is only for your own stores, install it right away. Submit a public app for review; once approved, it is listed in the app store.

A familiar REST API and signed webhooks.

Your app sends its access token in the Authorization header. The response is shaped by the token's permissions: personal data you have no permission for never enters the body.

  • Every webhook carries an HMAC-SHA256 signature built from the topic, store, timestamp and body
  • Your app computes the same signature with its own secret and compares them
  • Subscribing to an event name that does not exist fails at registration, so there are no subscriptions that silently never fire
API requestorders.read
GET /api/apps/v1/orders?page=1&pageSize=20
Authorization: Bearer mfapp_…

200 OK
{
  "items": [{
    "id": 1048,
    "status": "<status>",
    "grandTotal": 2349.90,
    "currency": "TRY",
    "customer": { "name": null, "email": null }
  }],
  "totalCount": 1, "page": 1, "pageSize": 20
}
Without the customers.read permission, the order list returns the customer's name and email as empty. The example is shortened.
WebhookPOST · application/json
POST <your webhook URL>
X-Milofly-Topic: order.paid
X-Milofly-Store: <store id>
X-Milofly-Timestamp: <Unix time>
X-Milofly-Hmac-Sha256: <signature>
  • order.createdOrder created
  • order.paidOrder paid
  • order.shippedOrder shipped
  • order.cancelledOrder cancelled
  • order.refundedOrder refunded
  • fulfillment.requestedFulfilment requested
  • shipment.create_requestedShipment requested
  • invoice.submit_requestedInvoice submission requested
  • app.uninstalledApp uninstalled
The signature is built with HMAC-SHA256 from the topic, store, timestamp and body. Your app does the same calculation with its own secret to verify the webhook.

Our own apps take the same path.

PaydaLink and TyreSystem run on separate servers, with the same API, permission screen and webhooks you will use. There is no special door for them in the core, and your app takes the same place they do.

  • PaydaLink

    PaydaLink

    Tracking codes and links for influencers. It receives order events as webhooks, writes the commission onto the order as a cost line and takes it back on a refund.

  • TyreSystem

    TyreSystem

    Brings a tyre wholesaler's catalogue, stock and prices from the Germany market into the store. It writes products through the app API and opens inside the admin.

Good to know before you start.

  • Scheduled jobsRun time-based jobs with a scheduler on your own server. Milofly does not schedule tasks on your app's behalf.
  • Paid appsSet up pricing plans for your app in the portal and see charges on the earnings screen. Talk to us before you publish a paid app.
  • For merchantsInstalling apps is open on every plan, so merchants on Starter can install your app too. Developer accounts and test stores are free.

Start building your app.

Open your developer account, read the docs and try it in a free test store.

Create a developer account Read the docs