---
title: "Shoply SaaS Management"
canonical_url: "https://ainode.run/docs/shoply-saas-management"
type: "doc"
locale: "en"
description: "Platform settings and deployed application and theme management."
---

# Shoply SaaS Management
> Platform settings and deployed application and theme management.

The Shoply extension provides `/admin/plugins/shoply/settings`, `/applications` and `/themes` under the same extension prefix. Connection and subscription license management retain their existing pages. The `apps` and `themes` extensions remain package catalogs and release registries; SaaS management does not call their APIs.

APay manages the operator UI and administrator permissions. Shoply owns runtime defaults, installation rules and registration. APay does not access Shoply's database.

| APay API under `/api/admin/plugins/shoply/` | Method | Permission | Shoply action |
| --- | --- | --- | --- |
| `settings/status` | GET | `plugin:shoply:settings:view` | `settings/get` |
| `settings/save` | POST | `plugin:shoply:settings:edit` | `settings/save` |
| `applications/list` | GET | `plugin:shoply:applications:view` | `applications/list` |
| `applications/register` | POST | `plugin:shoply:applications:edit` | `applications/register` |
| `applications/rule` | POST | `plugin:shoply:applications:edit` | `applications/rule` |
| `themes/list` | GET | `plugin:shoply:themes:view` | `themes/list` |
| `themes/register` | POST | `plugin:shoply:themes:edit` | `themes/register` |
| `themes/rule` | POST | `plugin:shoply:themes:edit` | `themes/rule` |

Responses use `{ code: 0, data }`. Settings return `{ settings, deployment, themeOptions }`; resource lists return `{ items, revision, defaultTheme }`. Resource rows report the deployed and registered versions, actual registration state, merchant availability and number of stores with installation records. The count does not represent active storefront use.

`settings/save` accepts `{ revision, defaultTheme }`. Registration accepts `{ uniqueName }`. Application rules accept `{ revision, uniqueName, appRule: { available, defaultInstall, required, cantManage } }`; theme rules accept `{ revision, uniqueName, themeRule: { available } }`. Required applications must be installed by default. The default theme must be registered and available. The SaaS management application cannot be offered to merchants or installed in merchant stores by default.

Default changes apply to new stores. Closing availability prevents new merchant installations; existing installations remain usable. Required rules affect already installed applications but do not install missing applications in existing stores. APay does not expose package replacement, file deletion or platform deployment controls.

Set `SHOPLY_PLATFORM_ADMIN_SECRET` (at least 32 characters) on both services. APay may set `SHOPLY_PLATFORM_API_URL`; otherwise it derives `/api/hook/saas-platform` from the existing partner origin. The platform credential is separate from `SHOPLY_PARTNER_SECRET`. Connection secrets remain environment-only. Shoply requires Redis and rejects requests when replay protection is unavailable.

Shoply actions are POST requests to `/api/hook/saas-platform/`. Headers are `X-Platform-Timestamp`, `X-Platform-Nonce` and `X-Platform-Signature`. The HMAC-SHA256 canonical string is `POST\nsaas-platform/\n\n\n`. Timestamps tolerate 300 seconds; nonces are atomically consumed for 600 seconds.

Concurrent settings edits return 409 (`revision_conflict`) and require refresh. Business rejection returns 422 (`operation_rejected`). Missing APay configuration returns 503 (`not_configured`); upstream or authentication failures return 502 with a stable reason. Worker reload failure returns `worker_reload_failed`: registration has already been saved and retry reloads workers without reinstalling the same version.

Deploy Shoply's platform API and APay's extension together. Rollback preserves persisted settings and registrations; reversing a deployment does not undo application migrations. Existing merchant and billing APIs retain their independent credentials and scopes.