---
title: Styling and Texts API
tags: [integration, styling, texts, backend, wordpress]
---

Change how the Dropin **looks** (colors, logo, images, start button) and what it **says** (every widget text, per language) from your own backend, with no Dashboard login. This is how a store plugin, for example the WooCommerce plugin, can offer design and copy settings inside WordPress.

> **In short** - Use the integration key you already have (the same one the **Webhook Integration Guide** uses). `PATCH /styling` changes the look, `PUT /texts/:lang` changes the copy. Send only what you want to change.

---

## 1. Authentication

Every request carries your POI's integration key:

```
Authorization: Bearer keyId.secret
Content-Type: application/json
```

- The key decides **which store** is changed. There is no `poiId` in these URLs, so a key can only ever edit its own store.
- Only a **store key** works here. A global (provider) key gets `403 INTEGRATION_KEY_NOT_POI_SCOPED`.
- Call from your backend only. Never put the key in the browser.

Base URL:

| Environment | Base URL |
|---|---|
| Production | `https://dropins.simplyclub.co.il/api/v1/integration` |
| Staging | `https://simply-drop-ins-2.onrender.com/api/v1/integration` |

---

## 1b. From the browser: a 15-minute token

If your settings screen calls us straight from the browser, **never send it the key**. Your backend trades the key for a short-lived token and gives that to the page:

```
POST /token
Authorization: Bearer keyId.secret
```

```json
{ "success": true, "data": { "token": "it1....", "expiresAt": 1792280900, "expiresIn": 900 } }
```

The page then calls `/styling` and `/texts/:lang` with `Authorization: Bearer it1....`.

- Valid **15 minutes**. On `401 INTEGRATION_TOKEN_INVALID`, ask your backend for a new one.
- Works **only** for styling and texts of this store. It cannot create another token.
- Revoking the key in the Dashboard kills its tokens at once.
- From a browser, the page must be on one of the store's domains, otherwise `403 INTEGRATION_ORIGIN_NOT_ALLOWED`.

---

## 2. Styling

| Method | Path | What it does |
|---|---|---|
| `GET` | `/styling` | Current styling |
| `PATCH` | `/styling` | Change the fields you send, keep the rest |

Editable fields:

| Field | Value |
|---|---|
| `primaryColor` | Hex `#RRGGBB` |
| `secondaryColor` | Hex `#RRGGBB` |
| `logoUrl` | Image URL |
| `profileCover` | Image URL (profile cover) |
| `otpModalImage` | Image URL (code screen) |
| `onboardingBackgroundImage` | Image URL (signup background) |
| `starterButtonDesign` | `{ position: "top"\|"bottom", layout: "full"\|"compact", alignment: "left"\|"center"\|"right", zIndex: 0-2147483647 }`, partial is fine |
| `triggerSelectors` | Array of CSS selectors that open the widget (max 20) |
| `termsAndConditions` | Terms of use, shown in signup. Markdown or HTML. `null` or `""` clears it |
| `welcomeMessage` | Shown to a new member after signup. Markdown or HTML. `null` or `""` clears it |
| `howToGetPointsUrl` | URL. `null` or `""` clears it |

```bash
curl -X PATCH https://dropins.simplyclub.co.il/api/v1/integration/styling \
  -H "Authorization: Bearer key_xxxxxxxxxxxxxxxx.your-secret-here" \
  -H "Content-Type: application/json" \
  -d '{
    "primaryColor": "#E91E63",
    "logoUrl": "https://example.com/logo.png",
    "starterButtonDesign": { "position": "bottom", "alignment": "right" }
  }'
```

`termsAndConditions` and `welcomeMessage` are rendered as **Markdown**, and HTML inside them works too (the Dashboard editor saves HTML). Send a JSON string; line breaks are `\n`:

```json
{
  "termsAndConditions": "## תנאי שימוש\n\n1. ההצטרפות למועדון ללא עלות.\n2. ההטבות בכפוף ל[תקנון המלא](https://example.com/terms).",
  "welcomeMessage": "**ברוכים הבאים!** קיבלתם 50 נקודות במתנה."
}
```

Any other field (login settings, credentials, membership products...) is refused with `400 INTEGRATION_FIELD_NOT_ALLOWED`, and the offending names are listed in `data.fields`. An invalid value (for example `"primaryColor": "red"`) is also a `400`. In both cases **nothing is saved**.

---

## 3. Texts

Languages: `he`, `en`, `ar`, `ru`.

| Method | Path | What it does |
|---|---|---|
| `GET` | `/texts/:lang` | Every text for that language (our defaults merged with yours). The keys in the answer are the keys you can change. |
| `PUT` | `/texts/:lang` | Change the keys you send, keep the rest |

```bash
curl -X PUT https://dropins.simplyclub.co.il/api/v1/integration/texts/he \
  -H "Authorization: Bearer key_xxxxxxxxxxxxxxxx.your-secret-here" \
  -H "Content-Type: application/json" \
  -d '{ "texts": { "welcome_to_club": "ברוכים הבאים למועדון שלנו", "logout": null } }'
```

- A string sets the text (max 5000 characters).
- `null` puts that key back to our default.
- An unknown key is refused with `400 INTEGRATION_TEXT_KEY_UNKNOWN`, so a typo never silently does nothing.

---

## 4. Responses

| Status | Meaning |
|---|---|
| `200` | `{ "success": true, "data": ... }` |
| `400` | Field not allowed, unknown text key, or invalid value. Nothing saved |
| `401` | `INTEGRATION_KEY_INVALID` - wrong or revoked key, or `INTEGRATION_TOKEN_INVALID` - token expired or its key revoked |
| `403` | `INTEGRATION_ORIGIN_NOT_ALLOWED` - token used from a page outside the store's domains |
| `403` | `INTEGRATION_KEY_NOT_POI_SCOPED` - a global key was used |
| `429` | More than 600 requests a minute for this key |

Browsers cache the storefront's styling and texts reads for a few minutes, so a change can take that long to show. Pass `stylingVersion` to make it show on the next page load: see [Preview Mode and stylingVersion](/content/dropins/preview-mode).

---

## 5. WordPress example

```php
$response = wp_remote_request(
    'https://dropins.simplyclub.co.il/api/v1/integration/styling',
    array(
        'method'  => 'PATCH',
        'headers' => array(
            'Authorization' => 'Bearer ' . $key_id . '.' . $secret,
            'Content-Type'  => 'application/json',
        ),
        'body'    => wp_json_encode( array( 'primaryColor' => '#E91E63' ) ),
        'timeout' => 15,
    )
);
```