> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# App Development Best Practices

Review the following best practices before submitting your app to the [App Marketplace](https://www.bigcommerce.com/apps/).

## OAuth flow

### Follow security best practices and requirements

[RFC 6749](https://tools.ietf.org/html/rfc6749#section-10) discusses OAuth security considerations, recommendations, and requirements. Here's a summary of important items applicable to apps:

* Request access tokens with minimal scopes necessary.
* Serve all redirect URIs over TLS.
* Keep access tokens confidential in transit and storage.
* Do not transmit access tokens, refresh tokens, or client credentials in the clear.
* Do not transmit authorization codes in the clear.
* Educate end-users about the risks phishing attacks pose.
* Provide mechanisms that make it easy for end-users to confirm the authenticity of your app.
* Implement CSRF protection on redirect URI.

For details, see [Security Considerations in RC6749](https://tools.ietf.org/html/rfc6749#section-10). For a list of the top web application security risks and best practices to avoid them, see [OWASP Top Ten](https://owasp.org/www-project-top-ten/).

## API requests

For recommendations on API request-related best practices, including rate limits, threading, parallel requests, and the finer points of request headers, see our article on [Best Practices](/developer/docs/overview/api-fundamentals/integration-design).

## Webhook events

### Use webhooks to keep app data up-to-date

Rather than polling endpoints, get notified when updates occur by subscribing to [webhooks](/developer/docs/integrations/webhooks).

## User interface

### Manage user session timeouts

The [BigCommerce SDK](https://www.npmjs.com/package/@bigcommerce/app-sdk-js) keeps apps synchronized with the control panel. To use it, load the SDK at the top of your application's main index. Since it runs as frontend code, it must be executed in the browser to function properly.

Run the following command to import the library:

```js showLineNumbers={false}
import 'bigcommerce-app-sdk-js';
```

Next, initialize the SDK. This should be done in the first part of the application that has access to the window object. In React-based applications, including Next.js, this can be done inside of `useEffect` or `componentDidMount` (for class components).

```js showLineNumbers={false}
window.bcAsyncInit = function() {
  Bigcommerce.init({
    onLogout: callback
  });
}
```

To enhance security, you can pass an `onLogout` callback, which triggers when a user logs out of the control panel—even from a separate tab. For example, the single-click app starter calls a Server Action that clears its own session cookie. See the following [example](https://github.com/bigcommerce-edu/starter-sc-app-next/blob/main/src/components/layout/bigcommerce-control-panel-sync.tsx#L55) for more details.

### Streamline new user onboarding

* If your app has a new user form, we recommend auto-filling input fields with data from the [Store Information API](/developer/api-reference/rest/admin/management/store-information/v3), which manages much of the info you need.
* If your app doesn't have an approval process for new users, consider automatically generating accounts for new stores that install your app.
* If your app requires the user to sign in at launch, use the information BigCommerce sends to your callback URL to authenticate the user without asking for a username and password each time.
* If you plan to share user testimonials, add a link to your full case study in the case studies field.

### Offer multi-user access

Merchants often have more than one person who can access a store's control panel. BigCommerce allows additional users to access an app when the store owner has granted them appropriate permissions. The requirements for supporting multi-user app access are:

* The app must save the API account access token for each store with its `store_hash`, rather than a user's info.
* In the app's [Developer Portal profile](https://build.bigcommerce.com), you must [enable multiple users](/developer/docs/integrations/apps/guide/managing-apps-in-dev-portal#edit-technical-details).

In the payload returned when a user launches an app, users are distinguished by `owner_email` versus `user_email`. If these two emails match, the user is the store owner.

Enabling user removal is optional. If you want merchants to be able to remove users, you can do so by writing a `remove_user` callback and [adding its URL](/developer/docs/integrations/apps/guide/managing-apps-in-dev-portal#edit-technical-details) to your app's [Developer Portal profile](https://build.bigcommerce.com). For more advanced implementations, you can enable the store owner to grant specific permissions to different non-admin users. For example, `person1@example.com` could be permitted to edit product inventory but not view orders. If you decide to implement user permissions in your app, it’s a great feature to advertise.

For more information, see [Multi-User Support](/developer/docs/integrations/apps/guide/supporting-multiple-users).

## Deployment

### Consider hosting on Google Cloud Platform's us-central1 region

BigCommerce hosts [Google Cloud Platform](https://cloud.google.com/) in the [us-central1](https://cloud.google.com/compute/docs/regions-zones/) region; maximize performance by hosting in the same region.

## Next steps

* [Check requirements](/developer/docs/integrations/apps/guide/approval-requirements).
* [Publish your app](/developer/docs/integrations/apps/guide/publishing-apps).

## Resources

### Sample apps

* [Node / React / Next.js](https://github.com/bigcommerce-edu/starter-sc-app-next)
* [Python / Flask](https://github.com/bigcommerce/hello-world-app-python-flask)
* [PHP / Silex](https://github.com/bigcommerce/hello-world-app-php-silex)
* [Ruby / Sinatra](https://github.com/bigcommerce/hello-world-app-ruby-sinatra)
* [Laravel / React](https://github.com/bigcommerce/laravel-react-sample-app)

### Tools

* [Node API Client](https://github.com/bigcommerce/node-bigcommerce/)
* [Python API Client](https://github.com/bigcommerce/bigcommerce-api-python)
* [PHP API Client](https://github.com/bigcommerce/bigcommerce-api-php)
* [Ruby API Client](https://github.com/bigcommerce/bigcommerce-api-ruby)
* [Ruby OmniAuth Gem](https://github.com/bigcommerce/omniauth-bigcommerce)
* [BigDesign Developer Playground](https://developer.bigcommerce.com/big-design)
* [Figma Component Library](https://www.figma.com/community/file/1359989842592268260/bigdesign-component-library)

### Blog posts

* [How to Test App Authentication Locally with ngrok](https://medium.com/bigcommerce-developer-blog/how-to-test-app-authentication-locally-with-ngrok-149150bfe4cf)
* [Building a BigCommerce App Using Laravel and React](https://medium.com/bigcommerce-developer-blog/building-a-bigcommerce-app-using-laravel-and-react-711ceceb5006)
* [BigDesign Tutorial](https://medium.com/bigcommerce-developer-blog/bigdesign-build-native-looking-uis-with-the-bigcommerce-design-system-fb06a01a24f2)