Authorize a published marketplace app, persist an active installation, mint a short-lived authorization code, then exchange it for a scoped app access token.
The developer portal is a docs-first workbench for the current `/v1` gateway, app OAuth, lifecycle webhooks, Liquid plus JSON-contract themes, GraphQL rollout status, and partner dashboard contracts.
POST /v1/app-store/apps/:id/oauth/authorize
{
"store_id": "site_uuid",
"redirect_uri": "https://partner.example/oauth/callback",
"code_challenge": "base64url_sha256_of_pkce_verifier",
"code_challenge_method": "S256",
"scopes": ["read_products"],
"state": "opaque-csrf-state",
"webhook_url": "https://partner.example/webhooks/letbuyy"
}Curated from the Hono gateway routes, schemas, auth middleware, and query-cost rate limiter.
Authorization-code install, token exchange, app bridge tokens, HMAC signatures, and compliance webhook topics.
JSON-contract theme bundles, app manifests, extensions, scopes, app blocks, and honest SDK/CLI gaps.
Developer apps, themes, API keys, installs, analytics, and earnings surfaced as real contracts or backend skips.
Every page in this portal is backed by the tracked gateway, webhook service, auth-core, app-engine, or theme-engine source. Missing data and tooling are visible as skips.
The active path is marketplace app registration, scoped install OAuth, lifecycle webhooks, theme package upload, and dashboard visibility. SDK and backend gaps are marked before they surprise a partner.
Authorize a published marketplace app, persist an active installation, mint a short-lived authorization code, then exchange it for a scoped app access token.
Storefront GraphQL `cart` reads use a persisted cart token backed by the storefront cart REST contract. Cart mutations stay on REST so clients share the same server-side cart before checkout.
No active `@letbuyy/cli`, app SDK package, theme CLI, or `create-letbuyy` package exists yet. The portal documents the contract and keeps CLI commands planned.