WowCodesDocs
BidKing Starter

REST API and mobile app

A JSON API at /api/v1/ for apps and other clients, and an optional mobile app for Android and iPhone that you build from source and publish under your own name.

The REST API

Every store answers at https://your-domain/api/v1/. Requests and answers are JSON.

Sign in

  1. Get tokens

    Send the customer's email and password to POST /api/v1/auth/login. The answer holds an access token and a refresh token.

  2. Call the API

    Send the access token on each request as Authorization: Bearer <token>.

  3. Refresh it

    An access token lasts 1 hour. Send the refresh token (as refresh_token) to POST /api/v1/auth/refresh for a new access token and the next refresh token. A refresh token lasts 30 days.

Two-step sign-in

When an add-on asks for a second step, such as an emailed code, POST /auth/login answers 401 with step_up and a challenge instead of a token. Send the challenge and the code to POST /auth/step-up-verify; POST /auth/step-up-resend sends a new code. A challenge lasts 10 minutes and works once.

Sign-in and password-reset requests are rate limited.

Core endpoints

AreaEndpoints
Accountauth/login, auth/register, auth/register/send-code, auth/refresh, auth/forgot-password, auth/logout-all, auth/me
Storeinfo, homepage, app/store-config, winners, search, search/trending
Walletwallet, wallet/transactions, wallet/topup, wallet/redeem
Customeruser/profile, user/addresses, user/avatar, user/orders, user/winnings, user/data-export, user/delete-account
Supportsupport/tickets (list, create, view, reply)
Otherreferral, notifications/fcm-token

Auctions add their own endpoints while the auction plugin is switched on. A developer adds one from a plugin with add_api_route(); the admin's built-in guide lists every endpoint on your store.

Partner API

To connect outside tools such as Zapier or Make, the Partner API & Zapier add-on, sold separately, gives each partner its own API key with only the scopes you tick, a rate limit, an IP allowlist and an expiry date.

The mobile app

The mobile app is a paid add-on. It is your store as an Android and iPhone app, under your own name and icon. The app shows your live site, so whatever you change on the site appears in the app straight away, with no new app release.

You build and publish it

The add-on gives you the app's source code, set up for your store. You build it yourself in Android Studio and Xcode, and publish it on Google Play and the App Store under your own developer accounts.

What you need

  • Your store online at an https:// address.
  • For Android: a computer with Android Studio and Node.js 20 or newer, and a Google Play developer account.
  • For iPhone: a Mac with Xcode and Node.js, and an Apple Developer account. An iPhone app can only be built on a Mac.
  • A free Google Firebase project, if you want push notifications.

Get the app

  1. Set the App ID

    Open Settings App & push. Under 1. Your app, set a unique ID written backwards from your domain, such as com.yourcompany.shop. It can't be changed once the app is in a store.

  2. Fix what the checklist marks

    The app's address and name come from your site address and store name in Settings General.

  3. Add push, if you want it

    Add the three Firebase files under 2. Push notifications. You can do this later, but then you download and build again.

  4. Download the source

    Choose Download app source (.zip). It comes set up with your address, name, app ID, logo and Firebase files.

  5. Build and submit

    Follow the README.md inside the zip: add your icon and launch screen, build in Android Studio and Xcode, and submit to the stores.

Download and rebuild only when you change the app ID, the Firebase files or the sign-in and link settings. Everything else reaches the app without a rebuild.

On the same page

  • iPhone purchases: Apple requires its own payment system for digital items bought in an iPhone app, such as coins and wallet top-ups. Keep Refuse digital purchases in the iPhone app on unless you have Apple's approval.
  • Sign-in and links: Google sign-in in the app, and links to your store that open the app instead of the browser.
  • What sends a push, Send for a test or a message to everyone, and History of every push, kept for 90 days.

The Mobile App Settings add-on, sold separately, chooses which sections customers can open inside the app, such as auction bidding. Every section starts hidden, so a fresh app is ready for store review.

If something's wrong

ProblemCheck
The app shows "Can't reach the server"Open the same page in a phone browser. If it fails there too, the problem is the site or the connection, not the app.
No push arrivesSend yourself a test on Send, then read its line on History. Most failures are Firebase files from a different project, or made for another app ID.
Google sign-in fails in the appThe Android client in Google Cloud needs your app ID and the SHA-1 of the key the app is signed with, from Google Play Console.
Store links open the browserFill in 4. Sign-in and links and rebuild. Links open the app only on phones that installed it from the store.

Something wrong or unclear on this page? Tell us at [email protected], or see how to get help.