Styling and Texts API

integration styling texts backend wordpress

Change how the Dropin looks (colors, logo, images, start button) and what it says (every widget text, per language) from your own backend, with no Dashboard login. This is how a store plugin, for example the WooCommerce plugin, can offer design and copy settings inside WordPress.

In short - Use the integration key you already have (the same one the Webhook Integration Guide uses). PATCH /styling changes the look, PUT /texts/:lang changes the copy. Send only what you want to change.

1. Authentication

Every request carries your POI’s integration key:

Authorization: Bearer keyId.secret
Content-Type: application/json

The key decides which store is changed. There is no poiId in these URLs, so a key can only ever edit its own store.
Only a store key works here. A global (provider) key gets 403 INTEGRATION_KEY_NOT_POI_SCOPED.
Call from your backend only. Never put the key in the browser.

Base URL:

Environment	Base URL
Production	`https://dropins.simplyclub.co.il/api/v1/integration`
Staging	`https://simply-drop-ins-2.onrender.com/api/v1/integration`

1b. From the browser: a 15-minute token

If your settings screen calls us straight from the browser, never send it the key. Your backend trades the key for a short-lived token and gives that to the page:

POST /token
Authorization: Bearer keyId.secret

{ "success": true, "data": { "token": "it1....", "expiresAt": 1792280900, "expiresIn": 900 } }

The page then calls /styling and /texts/:lang with Authorization: Bearer it1.....

Valid 15 minutes. On 401 INTEGRATION_TOKEN_INVALID, ask your backend for a new one.
Works only for styling and texts of this store. It cannot create another token.
Revoking the key in the Dashboard kills its tokens at once.
From a browser, the page must be on one of the store’s domains, otherwise 403 INTEGRATION_ORIGIN_NOT_ALLOWED.

2. Styling

Method	Path	What it does
`GET`	`/styling`	Current styling
`PATCH`	`/styling`	Change the fields you send, keep the rest

Editable fields:

Field	Value
`primaryColor`	Hex `#RRGGBB`
`secondaryColor`	Hex `#RRGGBB`
`logoUrl`	Image URL
`profileCover`	Image URL (profile cover)
`otpModalImage`	Image URL (code screen)
`onboardingBackgroundImage`	Image URL (signup background)
`starterButtonDesign`	`{ position: "top"\|"bottom", layout: "full"\|"compact", alignment: "left"\|"center"\|"right", zIndex: 0-2147483647 }`, partial is fine
`triggerSelectors`	Array of CSS selectors that open the widget (max 20)
`termsAndConditions`	Terms of use, shown in signup. Markdown or HTML. `null` or `""` clears it
`welcomeMessage`	Shown to a new member after signup. Markdown or HTML. `null` or `""` clears it
`howToGetPointsUrl`	URL. `null` or `""` clears it

curl -X PATCH https://dropins.simplyclub.co.il/api/v1/integration/styling \
  -H "Authorization: Bearer key_xxxxxxxxxxxxxxxx.your-secret-here" \
  -H "Content-Type: application/json" \
  -d '{
    "primaryColor": "#E91E63",
    "logoUrl": "https://example.com/logo.png",
    "starterButtonDesign": { "position": "bottom", "alignment": "right" }
  }'

termsAndConditions and welcomeMessage are rendered as Markdown, and HTML inside them works too (the Dashboard editor saves HTML). Send a JSON string; line breaks are \n:

{
  "termsAndConditions": "## תנאי שימוש\n\n1. ההצטרפות למועדון ללא עלות.\n2. ההטבות בכפוף ל[תקנון המלא](https://example.com/terms).",
  "welcomeMessage": "**ברוכים הבאים!** קיבלתם 50 נקודות במתנה."
}

Any other field (login settings, credentials, membership products…) is refused with 400 INTEGRATION_FIELD_NOT_ALLOWED, and the offending names are listed in data.fields. An invalid value (for example "primaryColor": "red") is also a 400. In both cases nothing is saved.

3. Texts

Languages: he, en, ar, ru.

Method	Path	What it does
`GET`	`/texts/:lang`	Every text for that language (our defaults merged with yours). The keys in the answer are the keys you can change.
`PUT`	`/texts/:lang`	Change the keys you send, keep the rest

curl -X PUT https://dropins.simplyclub.co.il/api/v1/integration/texts/he \
  -H "Authorization: Bearer key_xxxxxxxxxxxxxxxx.your-secret-here" \
  -H "Content-Type: application/json" \
  -d '{ "texts": { "welcome_to_club": "ברוכים הבאים למועדון שלנו", "logout": null } }'

A string sets the text (max 5000 characters).
null puts that key back to our default.
An unknown key is refused with 400 INTEGRATION_TEXT_KEY_UNKNOWN, so a typo never silently does nothing.

4. Responses

Status	Meaning
`200`	`{ "success": true, "data": ... }`
`400`	Field not allowed, unknown text key, or invalid value. Nothing saved
`401`	`INTEGRATION_KEY_INVALID` - wrong or revoked key, or `INTEGRATION_TOKEN_INVALID` - token expired or its key revoked
`403`	`INTEGRATION_ORIGIN_NOT_ALLOWED` - token used from a page outside the store’s domains
`403`	`INTEGRATION_KEY_NOT_POI_SCOPED` - a global key was used
`429`	More than 600 requests a minute for this key

Browsers cache the storefront’s styling and texts reads for a few minutes, so a change can take that long to show. Pass stylingVersion to make it show on the next page load: see Preview Mode and stylingVersion.

5. WordPress example

$response = wp_remote_request(
    'https://dropins.simplyclub.co.il/api/v1/integration/styling',
    array(
        'method'  => 'PATCH',
        'headers' => array(
            'Authorization' => 'Bearer ' . $key_id . '.' . $secret,
            'Content-Type'  => 'application/json',
        ),
        'body'    => wp_json_encode( array( 'primaryColor' => '#E91E63' ) ),
        'timeout' => 15,
    )
);