Shop-E-Business as a Developer Platform: Extend E-commerce with Expose API and Cloudflare Workers

Short answer: Shop-E-Business is not only a store builder for sellers — it is a base platform that developers and agencies can extend. Instead of building a store from scratch for every client, you onboard the client on Shop-E-Business (hosted storefront, checkout, orders, SEO and stock from $10/year with 0% commission) and add the custom part yourself: the Expose API sends every order to your server as a JWT-signed POST and accepts status updates back, and the generated Cloudflare Worker is an editable template where you can swap Stripe for a regional payment gateway, EasyPost for a regional courier, or add notifications and inventory logic. The only contract: /apiEndpoint returns { redirectUrl } and order updates go to /api/exposure/order-status with the seller JWT.

Why build on Shop-E-Business instead of from scratch?

Client needs	From scratch	On Shop-E-Business
Storefront, themes, product pages	Design and build	Included: 3 themes, slug URLs, SEO tags
Checkout and order dashboard	Build, test, secure	Included: COD, or online payment via your Worker
Hosting, SSL, updates	Your ongoing job	Handled by the platform
Custom domain	Configure server + certificates	TXT verification + automatic HTTPS
Payment gateway, courier, back-office sync	Build	You build only this part, on a documented contract
Platform cost for the client	Servers + maintenance	$10/year (৳499) + Tier-2 or add-on, 0% fees

You spend your hours on the integration that is unique to the client, not on re-implementing product pages, carts and order lists that every store needs.

What are the two extension points?

Extension point	Expose API	Payment & Courier Worker
Admin tab	Advance → Expose API	Advance → Payment & Courier
Where your code runs	Any public HTTPS endpoint you host	A Cloudflare Worker on the client's domain (/apiEndpoint, /stripe-webhook)
Buyer after checkout	Sent to the Redirect URL you configure	Sent to the redirectUrl your Worker returns (e.g. a hosted payment page)
Ready-made code	C# and Node.js signing / verification samples in the tab	Full Stripe + EasyPost Worker script, generated by the platform
Best for	ERP, accounting, warehouse, analytics, CRM	Online payment + automatic shipping, regional gateways and couriers

Both use the same order dispatch. When Payment & Courier is active, new orders go to the Worker's /apiEndpoint; if the client also needs your back-office system, forward orders to it from inside the Worker.

Is the Cloudflare Worker a black box?

No. It is a customizable template. The script the platform generates contains no seller-specific values — keys and secrets live in the Worker's own settings, and courier settings are fetched at runtime. The header of the script states the contract directly: you can customize it (other payment gateways, couriers, notifications, …) as long as:

1. POST /apiEndpoint verifies the Shop-E-Business JWT and returns { redirectUrl }, which the storefront sends the buyer to.
2. Order updates are posted to POST /api/exposure/order-status with a JWT signed by the seller (iss=seller-{ShopId}, aud=shopebusiness).

Everything between those two points is yours. The stock template shows a production-grade reference: Stripe Checkout Session creation, Stripe signature verification, EasyPost shipment lookup by order reference (so retries never buy twice), cheapest-rate-first buying with fallback, refund handling, 15-second timeouts on every outbound call and error messages scrubbed of credentials.

How do I plug in a regional payment gateway or courier?

The ready-made template targets Stripe and EasyPost. In many markets clients need local options instead; because nothing seller-specific is baked into the script, you can adapt your copy of the Worker:

Market	Examples	What to change
Bangladesh	bKash, SSLCommerz	Create the payment in /apiEndpoint; return its URL
India	Razorpay	Same pattern; confirm on the callback
Thailand	PromptPay	Return a payment page; report PaymentStatus
Any market	A regional courier API	Replace the EasyPost calls

These gateways and couriers are not built into Shop-E-Business; they are examples of integrations a developer can write inside the Worker.

1. Copy the generated script from Advance → Payment & Courier as your starting point.
2. In the /apiEndpoint handler, keep the JWT check and the CustomOrderId match, then create the payment with your gateway and return { redirectUrl }.
3. Handle the gateway's payment confirmation in the Worker (the stock template uses /stripe-webhook) and always verify the gateway's signature first.
4. On a confirmed payment, read the ship-from address and parcel defaults from GET /api/exposure/courier-config and book the shipment with your courier.
5. Post CustomOrderId, DeliveryStatus, DeliveryTrackingUrl and PaymentStatus to POST /api/exposure/order-status.
6. Return an error on any failed step if your gateway retries callbacks, and make shipment booking idempotent per CustomOrderId, as the stock template does with EasyPost.
7. Add extras in the same Worker: SMS or email notifications, inventory sync, a Slack or Google Sheets push.

What can I build with the Expose API?

The Expose API gives your system the order stream and a way to write status back, without touching Shop-E-Business internals.

Call	Direction	Purpose
POST {your ApiEndpoint}	Shop-E-Business → you	Every new order with a fresh CustomOrderId, line items, totals and billing details (including buyer email)
POST /api/exposure/order-status	You → Shop-E-Business	Body: CustomOrderId (required), DeliveryStatus (required, ≤100 chars), DeliveryTrackingUrl (optional absolute URL), PaymentStatus (optional). Updates every line of that order. Responses 200 / 400 / 401 / 404.
GET /api/exposure/courier-config	You → Shop-E-Business	The shop's ship-from address and default parcel length, width, height and weight

What you report shows up in Custom Order Management in the seller's dashboard (with manual status override) and on the buyer's public tracking page with a clickable tracking link. Typical builds:

• ERP / warehouse sync — push each order into the client's ERP and post back "Packed", "Shipped" and the courier tracking link.
• Accounting — create an invoice or journal entry per order and report PaymentStatus when it is settled.
• Fulfillment dashboards — a packing or dispatch screen for the client's team, driven by the order stream.
• Analytics — store orders in your own database or warehouse for sales, product and region reports.
• Own payment page — send buyers to the Redirect URL, take payment, then report the status.

How is the integration secured?

Direction	iss	aud	Rules
Inbound to your code (order dispatch)	shopebusiness	seller-{ShopId}	HS256, claims CustomOrderId and shop, 5-minute expiry, sent as Authorization: Bearer
Outbound from your code (status, courier config)	seller-{ShopId}	shopebusiness	HS256 with the same secret, CustomOrderId claim must equal the body, ≤5 minutes recommended (1-minute clock skew)

• One shared secret per shop — 48 random bytes generated by the server, shown only in the admin credentials panel and regenerable at any time.
• Webhook signature verification — the stock Worker verifies the Stripe signature before acting on any event.
• Secrets redacted from errors — Worker error text is scrubbed of the JWT secret, Stripe/EasyPost keys and tokens.
• Timeouts — every outbound Worker call has a 15-second timeout; platform dispatch uses a 10-second timeout without following redirects, so a slow server never blocks a sale.
• URL rules — endpoint and redirect URLs must be absolute public http(s) addresses (no localhost, no embedded credentials, max 1000 characters).

How can developers turn this into a business?

Because Shop-E-Business takes 0% commission and the platform fee is a small yearly amount, the value you add is the margin. Agencies and freelancers can sell:

• Payment gateway integration for a client's local market.
• Courier integration with automatic booking and tracking links.
• Back-office connectors — ERP, accounting, inventory, CRM.
• Custom dashboards and reports on top of the order stream.
• Maintenance retainers for the Worker and connectors you run.

A typical client onboarding:

1. Client signs up and subscribes; add Tier-2 or the custom-domain add-on.
2. Connect and verify the client's domain, move DNS to Cloudflare, set Proxied + SSL Full (Strict) — see the step-by-step domain, Stripe and courier guide.
3. Choose the extension point: Expose API for back-office systems, the Worker for payments and shipping.
4. Deploy your customized code, place a test order and confirm it appears in Custom Order Management.
5. Hand over the store; keep the integration as your service.

Platform references: e-commerce order API and webhooks, Stripe payments + EasyPost shipping, Stripe + courier integration guide and custom domain step by step. Related: e-commerce builder vs building from scratch.

Frequently Asked Questions

Can I use a payment gateway other than Stripe?

Yes, by customizing the Worker. The generated Cloudflare Worker is a template with nothing seller-specific baked in. As long as /apiEndpoint returns { redirectUrl } and order updates are posted to /api/exposure/order-status with a seller-signed JWT, you can replace the Stripe calls with a regional gateway such as bKash, SSLCommerz, Razorpay or PromptPay. The ready-made template targets Stripe; other gateways are integrations you write.

Can I swap EasyPost for a regional courier?

Yes, in your own copy of the Worker. Read the ship-from address and parcel defaults from GET /api/exposure/courier-config, call your courier's API, then report DeliveryStatus, DeliveryTrackingUrl and PaymentStatus to POST /api/exposure/order-status.

Do I need to redeploy when settings change?

Not for courier settings: the Worker reads them from Shop-E-Business at shipment time. You only update the Worker when you change its code, rotate a key, or regenerate the JWT secret in Advance > Expose API (then update SHOPEBUSINESS_JWT_SECRET).

What can I build with the Expose API?

Anything that needs the store's order stream: ERP and warehouse sync, accounting entries, fulfillment dashboards, analytics, CRM or Slack notifications, or your own payment page via the Redirect URL. Your system receives each new order as a JWT-signed POST and posts delivery, tracking and payment status back, which buyers see on their tracking page.

Can I use Expose API and Payment & Courier at the same time?

They share the same order dispatch. Activating Payment & Courier points new orders at your Worker's /apiEndpoint, so if you also need your own backend, extend the Worker to forward orders to it.

What does my client's store need for these features?

An active Shop-E-Business subscription with the custom domain feature (Tier-2 at $18/year or the add-on at $8/year; ৳1,500 and ৳1,000 in Bangladesh) and a saved custom domain the client owns. The Worker additionally needs the domain's DNS on Cloudflare, proxied, with SSL Full (Strict).