Creating a new app
To create a new app, use the
appCreate mutation. This mutation is only available to staff users with the
MANAGE_APPS permission. Staff user can't grant app more permissions than he has for his own. The mutation takes the following input fields:
name: the name of the app.
isActive: whether to activate the app, defaults to
permissions: list of permissions the app should be granted.
Let's assume that we want to create an order processing service that can fetch and manage orders in Saleor. To do so, we create a new app with the
If there are no errors in the response, a new app is created:
The response contains the
authToken field - this is the token that the app needs to include in requests to Saleor API to authorize itself and have access to queries or mutations that it needs.
authToken field is only available in the mutation response and cannot be fetched later, except for the last four digits.
Saleor API for apps uses a bearer token. To avoid sending passwords with each request, you need to first create a token, and then include it as a header with every GraphQL request.
The authorization header for apps has the following format:
Creating authorization keys
Creating an app with
appCreate mutation creates the default authorization token (
authToken). You can create more authorization keys with the
appTokenCreate. The mutation takes the following fields:
app: ID of the app.
name: (optional) name of the key.
Revoking authorization keys
To revoke an authorization key, use the
Webhooks can be used to receive data from Saleor when particular events happen. The available events are:
|Receive webhooks when any of the available events is triggered (wildcard event).|
|Quantity of a checkout line is changed.|
|A new customer account is created.|
|A new order is placed.|
|Payment is made and an order is fully paid.|
|An order is updated; triggered for all changes related to an order; covers all other order webhooks, except for |
|An order is cancelled.|
|An order is fulfilled.|
|A new fulfillment is created.|
|A new product is created.|
Webhooks' payloads are sent in
Subscribing to a webhook
To subscribe to a webhook, we need to first create an app with proper permissions. Let's assume that we want to extend the order processing app that we've created in the example above. The app should receive notifications whenever new orders are created in Saleor. To do so, we'll create a new webhook using the
webhookCreate mutation. The mutation takes the following input:
name: name of the webhook.
targetUrl: URL of a service that will receive webhooks requests.
events: list of the events to subscribe to.
app: ID of the app to which the webhook belongs.
isActive: whether to activate the webhook.
If there are no errors in the response, the webhook is successfully created. From now on, whenever a new order is placed, payload with order data will be sent to your
Updating a webhook
To update a webhook (e.g. to deactivate it or change the permissions), use the
webhookUpdate mutation. The mutation takes similar input fields as the
webhookCreate mutation. The example below shows how to deactive a webhook:
Removing a webhook
To fully remove a webhook, use the