SellubDevelopersIntegrations

Integrations

API keys

Issue from Settings → API Keys (requires IssueApiKey permission). Each key is scoped to:

  • One channel (or * for all)
  • A specific permission set (subset of the issuer’s permissions)
  • An optional expiry

Keys are shown once on creation. Store securely.

Webhooks

Configure outbound webhooks at Settings → Webhooks. Events available:

EventPayload includes
order.placedorder id, customer, items, totals
order.paid+ payment details
order.fulfilled+ tracking info
order.cancelled+ reason
seller.approvedseller id, channel, store type
seller.suspended+ reason
payout.completedseller id, amount, destination

Delivery semantics

  • Webhooks are signed with HMAC-SHA256 using your webhook secret.
  • Timeout: 10 s.
  • Retries: 5 attempts with exponential backoff (1m, 5m, 30m, 2h, 12h).
  • After 5 failures the webhook is disabled and an alert email is sent.

Verifying signatures

import { createHmac, timingSafeEqual } from 'crypto';
 
function verify(rawBody: string, signature: string, secret: string) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

DPS (checkout pipeline)

Sellub-storefront’s checkout is fully outsourced to DPS — the umbrella Duabalabs platform. The storefront does not call Paystack directly; it calls dps_checkout_create via @duabalabs/dps-client on a server-side route, and DPS handles Paystack init, splits, and webhooks.

For the full integration story — provisioning, the vendure flow, the VendureChannel mapping, the seed script, and how Sellub-server / -dashboard / -storefront sit on DPS — see Sellub on DPS.

Paystack

Sellub still owns the subaccount-creation call to Paystack (when a seller first connects bank/MoMo, via dps-e-billing plugin) and seller payouts. Checkout init + splits are delegated to DPS. Sellub’s PaystackPaymentPlugin wraps:

  • Charge (one-time card / MoMo / bank)
  • Subscription (Type 2 monthly billing)
  • Refund
  • Transfer (seller payouts to bank/MoMo)
  • Webhook handler (/webhooks/paystack) — verifies signature, updates order/payout state.

Sandbox keys for development; live keys in production env only.

Email

Transactional emails go through the configured provider (currently SMTP via Resend). Templates live in sellub-server/src/email-templates/. Hot-reload in dev; production rebuild required for template changes.

Search

Vendure’s default search uses Postgres full-text. Optional Elasticsearch plugin available — not currently enabled in production.

Embedding the docs

The docs site (this site) can be linked from anywhere using clean URLs:

  • /sellub/sellers/... for the user manual
  • /sellub/admin/... for the admin handbook
  • /sellub/developers/... for engineering docs

Use the Edit on GitHub link at the bottom of each page to propose changes.

RBAC internalsAPI reference