What an app is
What a Hekana app is, how first-party and third-party apps differ, what exists in the platform today and what is not available to outside developers yet.
On this page
A Hekana app is a program that runs outside Hekana and acts on one store through the Apps API, after the store owner has approved it. It can read orders, products and customers, place orders, make discount codes, message customers, keep its own small data store, offer a checkbox at checkout, and listen to store events through webhooks.
This section is for developers who build apps. To build a store theme, use the theme docs instead. The two are separate: a theme controls how a store looks, an app adds behaviour.
Status, 2026-10-25: early access. The Apps API, OAuth flow, webhooks and review exist and are tested in the platform. What outside developers cannot do yet is listed under "What is not available" below. Where a page says "not available", it is not built, and this site does not describe a workaround.
First-party and third-party apps
| First-party | Third-party | |
|---|---|---|
| Built by | Hekana | You |
| Appears in | The app catalogue, defined in Hekana's own code | The registry of approved apps, with a name, the scopes it asks for and whether it is embedded |
| Installed by | A switch in the dashboard | The store owner approving your consent screen |
| Talks to the platform through | Internal code | The Apps API with an OAuth token |
| Pricing | Free, usage or subscription tiers defined by Hekana | No listed price; you charge through the wallet (see Billing) |
| Theme blocks | Yes (Subscriptions, AI shopper) | Not available |
How the pieces fit
- You register an app and list the scopes it needs. It starts as a draft.
- You submit it. A Hekana reviewer approves it, sends it back with a reason, or suspends it (Testing and going live).
- Once approved, a store owner opens your consent link, sees the scopes, and approves. Your server exchanges the code for tokens (Authentication).
- Your server calls the Apps API with the installation's token and receives webhooks.
- The store owner can uninstall at any time (Install and uninstall).
Every token belongs to one installation, so every request is about exactly one store. An app cannot name another store, and a request that tries gets "not found".
What is not available
- No published packages.
@hekana/apps-sdk(a typed client and CLI) is in the Hekana repository as TypeScript source. It is not on npm.hekana-sdkandcreate-hekana-appare not on npm either, and the scaffolder targets a read-only agent API, not the Apps API. See Getting started. - No test mode. The consent flow only runs for approved apps. See Testing and going live.
- No third-party subscription plans, trials or one-time purchases. These exist for Hekana's own apps only. See Billing.
- No custom theme blocks. The list of blocks is closed and belongs to Hekana's own apps. See Theme editor blocks.
- No checkout fees or price changes. A checkout extension can only offer one of the store's own products.
- The developer portal is not open to everyone. Registering an app is an API call made with a store owner's session; the dashboard screen for it sits behind a platform setting.
Where to go next
- Getting started: register an app and make a first call.
- Authentication and scopes: the OAuth flow and what each scope allows.
- Apps API reference: every endpoint.
- Webhooks: events and signature checks.