Send the merchant to the authorize URL with a PKCE challenge. They approve on a DZBuild consent screen, and your server exchanges the code for one install token per store.
Send the token to api.dzbuild.app/v1. Poll GET /v1/orders?since= for new orders, or receive signed order events on a webhook URL on a domain you own (DZBuild refuses workers.dev addresses). Test on your own store, then submit the app for review.
See an example of merchant approval and the token response
DZBuild is the e-commerce platform for Algerian merchants. A DZBuild app is a web service you host, on your own Cloudflare account or your own server. A merchant installs it on their store, and your app reads and changes that store's orders, products, delivery, customers and WhatsApp messages through the REST API.
The merchant approves on DZBuild
Install orders-bot on your store
orders-bot asks for access to your store. Once you approve, it can only do the following.
What this app will be able to do
View orders (read only; it cannot create or change orders) orders:read
DenyApprove and install
You can remove the app at any time from the Extensions page.
Your server exchanges the code for the install token
POST https://dzbuild.com/oauth/apps/token
200 OK
{
"access_token": "dzpk_live_0a1b2c3d4e5f67.9f8e...",
"token_type": "Bearer",
"scope": "orders:read",
"store_id": 141,
"install_id": 7,
"stores": [
{
"store_id": 141,
"store_name": "My test store",
"install_id": 7,
"access_token": "dzpk_live_0a1b2c3d4e5f67.9f8e..."
}
]
}
One scope per kind of store data. The merchant sees one line per resource on the consent screen and grants only what you ask for. All scopes
Orders
Read orders and their items. Create orders, change their status, cancel them.
orders:readorders:write
Delivery
Hand an order to the store's courier.
delivery:send
Products
Catalogue and categories, with images, variants, offers, quantity rules and stock.
products:readproducts:write
Customers
Customers and each customer's orders.
customers:read
Landing pages
Landing pages and their sections, and the check that runs before publishing.
landing_pages:readlanding_pages:write
Shipping
Rates and settings, linked couriers, coverage, the wilaya and commune lists.
shipping:readshipping:write
Store
Profile, design, home page sections and themes.
store:readstore:write
Promo codes and pixels
Discount codes and tracking pixels.
promos:readpromos:writepixels:readpixels:write
Analytics
Store analytics and KPIs.
analytics:read
WhatsApp
Approved order templates, the store's wallet balance, the message log, and sending.
whatsapp:readwhatsapp:send
Rules to build on
One token per store
Install tokens start with dzpk_live_, have no expiry date, and are revoked the moment the merchant uninstalls your app.
120 requests per minute
Per install, checked before the store's shared budget. A 429 answer carries Retry-After.
Idempotency-Key on writes
POST, PATCH and DELETE need one. The response is stored for 24 hours and replayed when you retry.
HMAC-SHA256 webhooks
X-DZ-Signature covers the timestamp and the raw body. Reject anything older than 5 minutes. Up to 5 delivery attempts.
Webhooks need your own domain
DZBuild refuses webhook URLs on workers.dev. Until the app runs on a domain you own, poll GET /v1/orders?since= once a minute.
Any store plan
Every plan can install an app. Set a minimum plan in the console when your app needs one.
Review before listing
A draft app runs only on stores you own. DZBuild reviews it before other merchants can install it.
Free services by DZBuild
Beyond the app platform, DZBuild gives away two tools. Use them with or without a store.
DZShip: a free shipping API for Algeria
Create and track cash-on-delivery parcels from your own application. DZShip is a separate service by DZBuild: use your courier credentials, with no DZShip signup or API key.
The API is free to use. Your courier’s delivery charges still apply.
A till and stock program for shops in Algeria: barcode scanner, receipts, credit (kridi), backups. It works without internet. Link it to a DZBuild store and the catalogue, stock and online orders sync with the counter.
Free and open source (GPL-3.0-or-later). Windows 10 and 11, 64 or 32 bit.
The developer console lives in your DZBuild dashboard. Any account that owns a store can open it, and a draft app installs on your own store right away.