For developers

The merchants are already here. Build what they're missing.

Thousands of shop owners across Bangladesh run their stores on Bitcommerz without ever touching code. When they need something we don't do, they go looking in the App Store — and that is where your work shows up. Build it in any language, keep it on your own servers, and keep 75% of what it earns.

Two ways in

You can build an app, or you can build a theme

Either way you set it up in the Partner Panel, and our team looks it over before merchants can install it.

Apps

It lives on your servers, written in whatever you are comfortable withYou register it by filling in a form — there is nothing to uploadA merchant installs it in one click, and an OAuth handshake connects the two of youFrom there you can read their shop data, but only the parts you asked forCharge monthly, yearly, once, or for life — in taka, with a free trial if you want one

Themes

Start from our preset kit — React, TypeScript and Tailwind, already wired upOne command turns your work into a single zip fileUpload that zip in the Partner Panel and you are doneAny widget you invent stays yours, namespaced under your theme's nameThemes sell free or one-time, and our team sets the final price when it goes live

How it goes

Three steps, and none of them take long

Sign up

Make a partner account — it takes a minute, and the same one covers apps, themes and referrals. Nothing to pay, and nobody to convince first.

Build it

Wire up the token exchange, ask for the permissions you will actually use, and tell us which events you want to hear about. Everything you need is in the docs.

Send it in

Submit for review. Once we approve it, merchants can find it and install it. Shipping an update later is just submitting again — same name, new version.

Signing in

Merchants let you in, and can shut the door just as fast

If your backend needs to work while nobody is watching — a nightly sync, a scheduled report — there is a separate server-to-server flow with a one-hour token.

A code, not a key

When a merchant opens your app we hand it a single-use code. Your server trades that for a real token, so nothing sensitive ever sits in the browser.

64 hex · 60s · one use only

Tokens that expire

Access tokens are good for ten minutes, refresh tokens for thirty days. Refresh quietly in the background and the merchant never notices a thing.

10 min · 30 days

One look at your secret

We show your client secret once, the day your app is approved, and only ever keep a hash of it. Save it somewhere safe that same evening.

Shown once, at approval

Uninstall means uninstall

The moment a merchant removes your app, your access goes with it. Every call checks, so there is no awkward window to worry about.

Revoked on uninstall

Install → access token

// A merchant opens your app from their dashboard.
// We mint a one-time launch code: 64 hex, 60s TTL.
 
POST /app-oauth/token
Content-Type: application/json
 
{
  "grant_type": "authorization_code",
  "code": "<launch_code>",
  "client_id": "<client_id>",
  "client_secret": "<client_secret>"
}
 
// → access_token   expires in 10 minutes
// → refresh_token  expires in 30 days
// Renew with grant_type=refresh_token

Permissions & events

Ask for what you need, and we will keep you posted

Pick the permissions your app genuinely uses — reviewers notice when the list is longer than the feature. Then subscribe to the events you care about, and we will deliver them to your endpoint, signed, so you can prove they came from us.

What you can ask for

read_orderswrite_ordersread_productswrite_productsread_customerswrite_customersread_inventorywrite_inventoryread_analyticsread_shopmanage_webhooks

What we will tell you about

order.createdorder.paidorder.fulfilledorder.cancelledproduct.createdproduct.updatedcustomer.createdapp.installedapp.uninstalled

Verify a webhook

// X-Webhook-Signature: t=<unix>,v1=<hex>
// v1 = HMAC-SHA256("<t>.<rawBody>", secret)
 
const [t, v1] = header
  .split(',')
  .map(p => p.split('=')[1]);
 
const expected = crypto
  .createHmac('sha256', secret)
  .update(`${t}.${rawBody}`)
  .digest('hex');
 
if (v1 !== expected) return res.sendStatus(401);
 
// Retries: 6 attempts over 24h
// 1m · 5m · 30m · 2h · 6h · 24h

Getting paid

Three quarters of every sale is yours

The same split for everyone, from the first sale onward. No tiers to climb, no targets to hit, nothing to negotiate.

Your share

Of every app and theme sale

75%

The same on day one and day one thousand

Our cut

Hosting, billing, and getting you in front of merchants

25%

Taken off automatically

Buyer protection

A short wait before money is released

7 days

After that the balance is yours

What to expect

Apps can charge monthly, yearly, once or for life — in taka, and you can offer a free trial.

Themes are free or one-time only, and our team confirms the final price before yours goes on sale.

Every sale moves through a few states — pending, settled, held, then released — and you can watch it happen.

Your balance, your sales and your payouts all live in the Partner Panel. Payouts are still issued by hand at this stage, so they come from our team rather than on a fixed schedule.

Documentation

It is all written down

The publishing guide covers the whole thing — how apps run, what to configure, how themes are put together, and every place you can extend the storefront.

Building your app

How apps run, the token exchange, and a working Node example

App configuration

Permissions, events and your OAuth credentials

Distribution & lifecycle

Submitting, review, versions, and what uninstall does

Theme development

How the preset kit is built and where to change things

Custom widgets

Adding your own builder widgets to a theme

Publish pipeline

What happens after your theme is approved

Landing templates

Ship ready-made landing pages with your theme

Header & footer builder

Hooking your theme into the header and footer builder

Page builder templates

The default page layouts a theme can ship with

Custom checkout fields

Adding your own fields to a merchant's checkout

Read the full guide →

Theme starter kit

Clone it, run it, and see it in your browser

The starter kit is public on GitHub, and it mirrors the theme merchants already use. So the storefront running on your laptop is the one they will get.

React, TypeScript and Tailwind, set up for youA local preview that reloads as you typeIt checks your theme before you submit itOne command turns the whole thing into a zip

Get the starter kit Read the theme guide

See the rest of our GitHub →

theme-preset-kit

$ git clone https://github.com/Commerzly/theme-preset-kit
$ npm install
 
$ npm run dev # local preview
$ npm run validate # structure + slug checks
$ npm run build
$ npm run package # → dist/theme.zip
 
# Upload dist/theme.zip from the Partner Panel.
# Slug: lowercase-hyphen, and not one of
# default | grid | manfare | general

FAQ

Questions people ask us

Where does my app actually run?

On your own servers, in whatever stack you like. We never host or run your code — we just call the HTTPS endpoints you gave us.

Do I have to upload a file?

Not for an app. You fill in a form in the Partner Panel that points at your live URLs, and that is the whole submission. Themes are different — those you package into a zip and upload.

How does a merchant install my app?

From the App Store in their dashboard. When they open it, we hand your app a one-time code that is valid for about a minute. Your server swaps that for an access token, and you are connected.

What if I lose my client secret?

You cannot get it back — we only keep a hash, so nobody here can read it either. Get in touch and we will issue you a new one.

What happens when a merchant uninstalls?

Your access stops right away. Every call checks that the install is still active, so an uninstalled app stops working on its very next request. Clean up your side and you are done.

How do I know a webhook really came from you?

Every delivery is signed. You recompute an HMAC-SHA256 of the timestamp and the raw body using your webhook secret, and compare it with the signature header. If we cannot reach you, we keep trying — six attempts spread over a day.

What does review look at?

A person from our team reads every submission. Your URLs have to be HTTPS and publicly reachable, and your permissions and events have to be ones we support. Most of what gets sent back is an app asking for more access than it uses.

How do I ship an update?

Submit again under the same name. That becomes a new version and goes back into the queue — merchants who already installed it keep working in the meantime.

Can I sell a theme as a subscription?

No — themes are free or a one-off purchase, and we confirm the final price with the listing. Subscriptions are for apps, which can be monthly, yearly, lifetime or one-time.

Is there an SDK I should install?

There is nothing to install. It is plain HTTPS and OAuth, so use whatever language you already know. The only public repo we have today is the theme starter kit.

Come build something

Sign up, register your first app or theme, and send it in. It costs nothing to start, and the merchants are already waiting.

Open the Partner Panel →Read the docs

One free account covers apps, themes and referrals — and 75% of every sale is yours.