For developers
A B2B platform your developers will enjoy building on
Your in-house developers and your agency shouldn’t have to learn a new way of working. TierCommerce uses the patterns they already know: Liquid themes, a documented REST API, signed webhooks and OAuth.
Familiar tools, B2B underneath
-
Liquid themes
Shopify’s folders, objects, tags and filters, with B2B components for prices, cart and checkout. Every download includes an AGENTS.md for a developer or an AI coding tool.
-
REST API and webhooks
A REST API described in an OpenAPI 3.1 spec, scoped tokens, and signed webhooks when orders, quotes, invoices and forms change.
-
Buyer apps
Let your customers’ procurement systems and AI agents browse and order for a buyer, over OAuth, within that buyer’s role.
How it fits together
Everything your developers build goes through the same rules as the storefront. Prices, permissions and approval rules apply whether an order comes from a buyer, a script or an app.
What your developers build
With the tools they know
-
Themes and scripts Liquid, storefront events and actions
-
Integrations Your code, Zapier or Make, with an API token
-
Buyer apps Procurement systems and AI agents, over OAuth
The TierCommerce platform
- Checks every request against the person’s role
- Applies each account’s prices and approval rules
- Signs every webhook it sends
- Records every change in the audit log
What comes back
Documented and predictable
-
JSON from the API Catalogue, prices, customers, orders and invoices
-
Signed webhooks Orders, quotes, invoices, syncs and forms
-
Storefront HTML Whole pages, or one section with ?section_id=
How it works
What an agency might build for Brightline Trade in its first few weeks.
-
1
Read data with a scoped token
The REST API reads your catalogue, the price any account pays, customers, orders, quotes, invoices and form submissions. The full OpenAPI 3.1 spec is at /api/v1/openapi.json, so your developers can generate a client from it.
- Scopes such as orders:read and pricing:read
- A token can never do more than the person who made it
- Tokens last 30, 90 or 365 days, and can be revoked at once
-
2
Hear about changes the moment they happen
Subscribe to the events you care about on the Webhooks page or through the API. Each delivery carries the object as the API returns it, so your code handles one shape.
- Retried after 1, 5 and 15 minutes, then up to 12 hours
- A 30-day delivery log, Send again and Send test event
- The same event id on a replay, so you never handle it twice
-
3
Check every delivery is really from us
Every webhook is signed with HMAC-SHA256 and a timestamp. Your receiver works out the signature, compares it in constant time, and refuses anything more than five minutes old.
- A signing secret per webhook, shown once
- HTTPS addresses on the public internet only
- Switched off after repeated failures, and your team emailed
-
4
Let your customers’ apps order for them
Register a buyer app, and a customer’s procurement system or AI agent can act for one of their buyers. The buyer signs in on your storefront, sees what the app is asking for, and allows it. The app then works within that buyer’s role.
- OAuth, with PKCE for mobile and desktop apps
- Only the account’s own prices, and only if the buyer can see prices
- Orders go through checkout and approval rules, on account
-
5
Add scripts that know what the buyer is doing
Add chat widgets, visualisers and tracking tags per storefront, in the head, the footer, under the buying panel or under the cart. Scripts can follow storefront events and add to the cart themselves.
- tc:page:view, tc:product:view, tc:variant:change, tc:cart:update and tc:cart:open
- Grouped by consent: essential, functional, analytics or marketing
- Never run on checkout, where card details are entered
Guard rails your security team will like
Developer-friendly doesn’t mean open. Every way in has limits, and everything is recorded.
- Tokens that never exceed their maker’s role
- Two-factor authentication for staff who manage tokens
- 120 requests a minute per token, 600 per business
- A 429 and Retry-After, not silent failures
- Everything a token changes in the audit log
- A token only ever reaches your business’s data
- Storefront events that never include personal details
- Revoke a token or a buyer app at once
Need to change how TierCommerce itself works?
For rules and modules beyond the API, such as installation bookings or project pricing, your developers can build on the platform with our extension SDK.
Building storefronts for clients?
Agencies that build on TierCommerce can register their interest as a certified partner.
For developers questions
Does TierCommerce have an API?
Yes. A REST API at /api/v1, described in full in an OpenAPI 3.1 spec. API tokens read your catalogue, prices, customers, orders, quotes, invoices and form submissions, and manage webhooks.
Can the API change products or prices?
No. Your ERP is the source of truth, so the merchant API reads what your ERP syncs. Buyer apps can place orders and handle quotes for a buyer, through the same checkout as the storefront.
How do we know a webhook came from TierCommerce?
Every delivery has a TierCommerce-Signature header with a timestamp and an HMAC-SHA256 signature of the body, keyed with that webhook’s secret. Check it, and refuse anything more than five minutes old.
Can an AI agent order on our storefront?
Yes, as a buyer app. The buyer allows it on your storefront, and it acts as that buyer within their role: their prices, their approval rules, and every action recorded as them.
Do our developers need to learn a new theme language?
Not if they know Shopify. Themes are Liquid in Shopify’s folders, with Shopify’s object names, tags and filters.
Can we use AI coding tools on our theme?
Yes. Every theme download includes an AGENTS.md that explains the platform’s conventions to a developer or an AI coding tool.
See TierCommerce working in 30 minutes.
Tell us which ERP you run and the features that matter to you. We’ll walk you through a working store, end to end.