Getting Started

The mental model

A Prebit app has up to two parts:

Your backend — runs on your own infrastructure (Node, Python, Go, PHP, whatever). It calls the Partner API, receives webhooks, and is the only place your business logic and secrets live. Prebit never sees your source code and never runs it.
Your extension (optional) — small, reviewed, sandboxed JS/CSS/ template assets that Prebit itself renders inside a merchant's storefront (a chat widget, a promo banner, a reviews block). These go through Prebit's review pipeline and run inside the Extension Runtime, never as a script tag Prebit trusts blindly.

Most apps start with just #1. You only need #2 if your app needs to put something visible on the storefront itself.

Three invariants hold everywhere in this platform:

Your app never touches theme.bit, section source, or checkout source.
Your backend source is never uploaded to or executed by Prebit.
Every interaction that does touch Prebit — API calls, webhook delivery, storage, billing — passes through one authorization layer (the Platform Kernel), enforcing the scopes and capabilities your installation was actually granted.

What you can build today

Capability	Status
Read/write products (create, update, delete, set inventory)	✅ Built
Read/write collections (manual and rule-based)	✅ Built
Read orders	✅ Built
Read customers (aggregate fields; PII behind a separate scope)	✅ Built
Read store info	✅ Built
Receive webhooks for order/product/collection/inventory/checkout events	✅ Built
Small namespaced key-value storage (Extension Storage)	✅ Built
In-storefront UI via the Extension Runtime (`app_embed`)	✅ Built (Phases 1–4), never run against a real deployed extension
Background job ("sync now") / scheduled job (cron) manifest declarations	Manifest schema accepts them; the dispatcher that calls your endpoint on a schedule is Stage 2 — see Jobs
Charge merchants for your app (`billing = "prebit"`)	Charging works; you never call an API to trigger it — see Billing
Get paid out (developer payouts)	❌ Not built
In-editor blocks (`app_block`)	❌ Not built — gated on theme-editor infrastructure
Public self-service app submission	❌ Not open — curated partners only

Five things you need before writing code

A developer organization — created in the Developer Portal (/developers).
A PartnerApp registration — client ID/secret, redirect URIs, requested scopes.
A prebit.app.toml manifest — see Publishing & Manifest.
An OAuth redirect URI on your own server — see OAuth.
A merchant test store to install into.

The fastest path

npx create-prebit-app my-app
cd my-app
npm install
cp .env.example .env.local   # fill in PREBIT_CLIENT_ID / PREBIT_CLIENT_SECRET
prebit login                 # paste a token from /developers/settings/tokens
prebit dev                   # opens a tunnel, prints the redirect_uri to register

This gives you a real OAuth callback and a real webhook receiver already wired up — see prebit-app-template-next.

Local development note

There is no hosted sandbox merchant store yet. Build against a real test store; prebit dev opens a cloudflared tunnel (if installed) for your OAuth redirect and webhook endpoint.