Skip to main content
Tassyir is the back office of e-commerce merchants in Algeria: orders (mostly cash on delivery), products and stock, delivery carriers, customers, and several stores per business. An app adds to it. A merchant installs your app on a business, and the app then reads and changes that business’s data, receives its events, and can show its own pages inside the dashboard.

​
What an app is

An installed app is a team member of the business. It acts with exactly the scopes the merchant granted, only in the stores the merchant gave it, and under the merchant’s plan: a plan limit refuses an app the way it refuses the merchant. The changes an app makes to orders, the catalogue and stock are written to the business’s activity log under the app’s name. An app runs on your own server today (hosting.mode = "external" in the manifest). Tassyir Hosting, where an app runs on Tassyir with no server to manage, is coming; an app moves there with the same manifest, API and webhooks. Apps are custom apps for now: one installs on the businesses its developer owns, and on one other business the developer names. A public catalogue of apps comes later.

​
The parts

Start with Getting started: it creates an app, runs it on your machine and installs it on a dev store.

​
The packages

A command-line tool, tassyir, is coming. Until it ships, the developer console in the dashboard does what it will do from a terminal.

​
Addresses

​
Rules every app follows

  • The ID token is the only proof of who is looking. Your page’s address says nothing Tassyir vouches for. Verify an ID token on your server (Tokens).
  • Money is a decimal string ("2500.00") next to a currency. Never turn it into a JavaScript number (Admin API conventions).
  • Act on an error’s code, and read its fix. Every refusal has a stable code and one sentence that says what to do (Errors).
  • Webhooks arrive at least once, in any order. Verify each one on its raw body, and skip a webhook-id you already handled (Webhooks).
  • Ask for the fewest scopes. A merchant sees every scope, and a new one needs their consent again (Scopes and consent).
  • Never put a secret in a page, a URL, a log or a repository. Client secrets and tokens live on your server.

​
About the code in these guides

The code is TypeScript on the published packages, and a check compiles every sample against them. Server code runs on Node 22.18 or later and on Workers-like runtimes; page code runs in the browser. To keep samples short, some use names set up once elsewhere: Every API version is dated. These guides describe version 2026-10.