Where the Seller API belongs in your stack — and where it must never appear.
What this covers#
Service-layer placement, common topologies (monolith, microservice, event-driven), commerce-platform hooks, and the hard rule that Seller API credentials stay on the server. Avrix is not a replacement for Steam, Epic, or other platform store APIs.
Hard rule: server-side only#
Your Seller API key authenticates your backend to Avrix. Never put the key in:
- Browser JavaScript or storefront themes
- Mobile or desktop app clients
- Public CDN assets or client-side SDKs
The storefront talks to your API; your API talks to Avrix.
Placement in your app#
Typical layers:
| Layer | Responsibility |
|---|---|
| Controller / route | Accept checkout events from your store; validate session |
| Service | Preview → charge at your PSP → create order; map errors |
| Worker / queue | Webhook verification, retries, catalog sync, reconciliation |
Keep Avrix HTTP calls inside the service (or a dedicated Avrix client module). Controllers should not assemble Bearer headers or invent idempotency keys ad hoc.
Topology choices#
Monolith#
One app process owns catalog sync, checkout, and webhook handlers. Fine for most keyshops. Use a shared HTTP client and a single secrets source.
Microservice#
Split “catalog sync”, “checkout / orders”, and “webhooks” if teams own them separately. Share the same sandbox vs production key policy; do not mint a key per microservice unless scopes require it.
Event-driven#
Emit internal events after PSP success (OrderPaid) and after Avrix fulfilment
(OrderFulfilled). Consumers update entitlement or email delivery. Always
verify Avrix webhook signatures before side effects — see Webhooks.
Commerce stacks#
| Stack | Typical hook |
|---|---|
| Laravel / Magento / WooCommerce | Server plugin or module after payment success |
| Shopify | App backend / webhook worker — not theme Liquid |
| Spring / .NET publisher portals | Service layer behind authenticated admin APIs |
Steam / Epic boundary#
Platform store APIs (Steamworks, Epic Online Services, and similar) manage their storefronts, entitlements, and ownership. Avrix Seller API manages your allocated inventory and fulfilment for stores you operate. Do not expect Avrix endpoints to create Steam packages or Epic offers; integrate those platforms on their own contracts, and use Avrix where you sell keys through your commerce stack.
Common mistakes#
- Calling Avrix from checkout JavaScript “for speed”.
- Sharing one production key across unrelated environments.
- Treating webhook delivery as optional and never reconciling — see Polling and reconciliation.
Next steps#
- API clients — language-specific HTTP setup
- Commerce platforms — Shopify, Woo, Magento, keyshops
- Store integration profiles — Profile A/B/C