> ## Documentation Index
> Fetch the complete documentation index at: https://developers.tassyir.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Build apps for Tassyir

> What a Tassyir app is, the parts of the app contract, and where each guide fits.

[Tassyir](https://tassyir.io) is the back office of e-commerce merchants in
Algeria: orders (mostly cash on delivery), products and stock, delivery
carriers, customers, and several stores per business. An app adds to it. A
merchant installs your app on a business, and the app then reads and changes
that business's data, receives its events, and can show its own pages inside
the dashboard.

## What an app is

**An installed app is a team member of the business.** It acts with exactly
the scopes the merchant granted, only in the stores the merchant gave it, and
under the merchant's plan: a plan limit refuses an app the way it refuses the
merchant. The changes an app makes to orders, the catalogue and stock are
written to the business's activity log under the app's name.

An app runs on **your own server** today (`hosting.mode = "external"` in the
manifest). Tassyir Hosting, where an app runs on Tassyir with no server to
manage, is coming; an app moves there with the same manifest, API and
webhooks.

Apps are **custom apps** for now: one installs on the businesses its
developer owns, and on one other business the developer names. A public
catalogue of apps comes later.

## The parts

| Part | What it is | Guide |
| - | - | - |
| Manifest | `tassyir.app.toml`: what the app is, the scopes it asks for, its address, page and webhooks | [The manifest](/guides/manifest) |
| Scopes and consent | What a merchant grants on install, and how a new version asks again | [Scopes and consent](/guides/scopes-and-consent) |
| Tokens | ID tokens, offline and online access tokens, refresh tokens, install codes | [Tokens](/guides/tokens) |
| Embedded pages | Your page inside the dashboard, talking to it through App Bridge | [Embedded pages and App Bridge](/guides/embedded-pages) |
| Webhooks | Signed deliveries of the business's events | [Webhooks](/guides/webhooks) |
| Admin API | The versioned REST API an app calls | [Admin API conventions](/guides/admin-api) |
| Orders | Read, create, edit, confirm, cancel and comment on orders | [Orders](/guides/orders) |
| Products and collections | The catalogue, its images and collections | [Products and collections](/guides/products-and-collections) |
| Stock | Stock levels, and correcting a count | [Stock](/guides/stock) |
| Customers | Buyers and their delivery record, and the contact data scope | [Customers and contact data](/guides/customers) |
| Stores and delivery | A business's stores, carriers and delivery prices | [Stores and delivery](/guides/stores-and-delivery) |
| App data | Values your app keeps in Tassyir, next to the merchant's resources | [App data](/guides/app-data) |
| Dev stores | Test businesses with synthetic data, where nothing reaches the outside world | [Dev stores](/guides/dev-stores) |
| Compliance and uninstall | What happens when a merchant uninstalls, and the buyer data requests an app must honour | [Compliance and uninstall](/guides/compliance-and-uninstall) |
| Errors | Every error code, and what to do about the common ones | [Errors](/guides/errors) |

Start with [Getting started](/guides/getting-started): it creates an app, runs it
on your machine and installs it on a dev store.

## The packages

| Package | Use it for |
| - | - |
| [`create-tassyir-app`](https://github.com/tassyir/apps-sdk/tree/main/packages/create-tassyir-app) | `npm create tassyir-app`: a working app to start from |
| [`@tassyir/app`](https://github.com/tassyir/apps-sdk/tree/main/packages/app) | Your server: tokens, ID-token and webhook verification, the typed Admin API client |
| [`@tassyir/app-bridge`](https://github.com/tassyir/apps-sdk/tree/main/packages/app-bridge) | Your page in the dashboard: ID tokens, toasts, modals, the save bar, navigation, pickers |
| [`@tassyir/app-manifest`](https://github.com/tassyir/apps-sdk/tree/main/packages/app-manifest) | Validating `tassyir.app.toml` with the same code the Tassyir API runs |

A command-line tool, `tassyir`, is coming. Until it ships, the developer
console in the dashboard does what it will do from a terminal.

## Addresses

| What | Where |
| - | - |
| Admin API | `https://api.tassyir.io/apps/2026-10/` |
| Token endpoint | `POST https://api.tassyir.io/apps/oauth/token` |
| ID-token public keys | `GET https://api.tassyir.io/apps/.well-known/jwks.json` |
| Webhook public keys | `GET https://api.tassyir.io/apps/webhook-keys` |
| Your page in the dashboard | `https://app.tassyir.io/{locale}/dashboard/{businessId}/apps/{handle}/{path}` |
| Developer console | `https://app.tassyir.io/en/developers` |

## Rules every app follows

* **The ID token is the only proof of who is looking.** Your page's address
  says nothing Tassyir vouches for. Verify an ID token on your server
  ([Tokens](/guides/tokens)).
* **Money is a decimal string** (`"2500.00"`) next to a `currency`. Never turn
  it into a JavaScript number ([Admin API conventions](/guides/admin-api)).
* **Act on an error's `code`, and read its `fix`.** Every refusal has a stable
  code and one sentence that says what to do ([Errors](/guides/errors)).
* **Webhooks arrive at least once, in any order.** Verify each one on its raw
  body, and skip a `webhook-id` you already handled ([Webhooks](/guides/webhooks)).
* **Ask for the fewest scopes.** A merchant sees every scope, and a new one
  needs their consent again ([Scopes and consent](/guides/scopes-and-consent)).
* **Never put a secret in a page, a URL, a log or a repository.** Client
  secrets and tokens live on your server.

## About the code in these guides

The code is TypeScript on the published packages, and a check compiles every
sample against them. Server code runs on Node 22.18 or later and on
Workers-like runtimes; page code runs in the browser. To keep samples short,
some use names set up once elsewhere:

| Name | What it is |
| - | - |
| `tassyir` | Your server's `TassyirApp`, from `createTassyirApp` ([Tokens](/guides/tokens)) |
| `admin` | An Admin API client for one installation, `tassyir.admin(installationId)` ([Admin API](/guides/admin-api)) |
| `installationId` | The installation your code is working for |
| `bridge` | Your page's App Bridge, from `createAppBridge()` ([Embedded pages](/guides/embedded-pages)) |

Every API version is dated. These guides describe version `2026-10`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.