Developer guide
Connect an existing website to the Ondes PRO store
Your site is already live — Next.js, Astro, WordPress, Symfony or hand-written HTML — and you want to sell from it without moving to a site builder. This guide shows how to display the Ondes PRO catalogue, run the cart and take Stripe payments from your own pages, in two flavours: entirely in the browser, or server-side through the REST API. Ondes PRO stays in charge of prices, stock and orders.
Type your workspace name: the configurations on this page adapt. It is remembered in this browser only.
Browser or server: which store API should you use?
Ondes PRO exposes two doors that are not meant to be mixed. The public store (/shop/api/…) is anonymous and designed to be called with fetch() from a visitor’s browser: catalogue, cart, payment. The REST API v1 (/api/v1/…) requires a key and belongs to code running on your own server.
The rule that follows is short: an API key never leaves your server. A static site or a single-page app uses the public store; a server-rendered site may prefer API v1, which adds idempotency and test mode. Both end up in the same place — an order in Store & Orders, paid into your company’s Stripe account.
Display the catalogue and take payments from your site, step by step
This flavour works with any stack, since everything happens in the browser. Set your subdomain at the top of the page to adapt the addresses.
Declare your site’s origin
In API & Developers → Allowed origins (or, under Configuration, the section on letting a website query this workspace), add your site’s exact address (
https://www.atelier-lumen.com, no path). Without it the browser blocks your workspace’s responses and nothing renders — that is CORS doing its job, not an API outage. Only the workspace superuser can change this setting.Connect your Stripe account
Still in Configuration, click “Connect my Stripe account”. Payments land directly in your account through Stripe Connect. A subsidiary without its own account collects through the parent company’s.
Load the catalogue
An anonymous call returns published products grouped by category. The response is cached on the Ondes PRO side, so calling it on every page view is fine.
javascriptconst response = await fetch('https://your-workspace.ondes.pro/shop/api/products/'); const catalogue = await response.json(); // Render each product's name, price and image in your own templates.Create the cart and add items
A first
GET /shop/api/cart/with no parameter creates a cart and returns itscart_token: keep it inlocalStorage. Every add or quantity change goes throughPOST /shop/api/cart/update/?cart_token=….javascriptawait fetch('https://your-workspace.ondes.pro/shop/api/cart/update/?cart_token=' + cartToken, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ action: 'set', product_id: 12, quantity: 2 }), });Prepare the payment
POST /shop/api/payment-intent/with thecart_tokenand customer details returns aclient_secret. Ondes PRO recomputes the amount from the cart, so a price edited in the browser changes nothing. A cart mixing two companies’ products is rejected (400): one charge cannot be split across two accounts.Confirm with Stripe.js
Load Stripe.js with
<script src="https://js.stripe.com/v3/">and confirm the payment with theclient_secret. Your account’s publishable key is read once server-side (see below); it is public by design and can sit in the page.Receive the confirmation by webhook
Register your server’s address in API & Developers, Test mode tab, webhooks section: the
commande.payeeevent arrives there, signed with theOndes-Signatureheader. Test and production endpoints are separate and each is switched on independently.
The browser-side checkout, end to end
A minimal example with Stripe’s Payment Element. The publishable key (pk_…) belongs to your connected account.
const stripe = Stripe('pk_live_…');
const response = await fetch('https://your-workspace.ondes.pro/shop/api/payment-intent/', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
cart_token: cartToken,
email: 'hello@maison-verdier.com',
first_name: 'Claire',
last_name: 'Verdier',
}),
});
const { client_secret } = await response.json();
const elements = stripe.elements({ clientSecret: client_secret });
elements.create('payment').mount('#payment');
document.querySelector('#pay').addEventListener('click', async () => {
await stripe.confirmPayment({
elements,
confirmParams: { return_url: 'https://www.atelier-lumen.com/thanks' },
});
});The amount never travels through the browser: Ondes PRO computes it from the cart.
Server-side flavour: create the order through the REST API
If your site has a backend (Next.js, Laravel, Django, Rails…), API v1’s shop/commandes resource creates the order and its payment in one call: the response already holds paiement.client_secret, ready for Stripe.js. That secret is only returned on creation and never read back. A key carrying shop:write is enough.
Two safeguards make this route comfortable. The Idempotency-Key header guarantees that a retry after a dropped connection does not create a second order — so nobody is charged twice. And the /api/v1/test/shop/commandes/ twin creates a test order, kept out of revenue figures, with a simulated payment page returned in paiement.checkout_url.
Create a test order from your server
curl -X POST https://your-workspace.ondes.pro/api/v1/test/shop/commandes/ \
-H "Authorization: ApiKey opk_…" \
-H "Idempotency-Key: cart-7f3c2a91" \
-H "Content-Type: application/json" \
-d '{
"items": [{"product": 12, "quantity": 2}],
"email": "hello@maison-verdier.com",
"first_name": "Claire",
"last_name": "Verdier",
"return_url": "/thanks"
}'Drop /test for production. GET /api/v1/shop/commandes/configuration-paiement/ tells you which Stripe account applies and returns its publishable_key.
“Connect my site”: an agent that does the integration in your GitHub repository
Rather hand it off? In Store & Orders, the My site tab links your site’s repository, on GitHub or in Ondes GIT. An AI agent reads your code, asks its questions before writing anything (where the product grid goes, which thank-you page to use), then proposes a diff for you to review. Nothing is committed or pushed without your say-so, and the agent never force-pushes: on a conflict it opens a new branch.
The agent works from a contract derived from your workspace’s real routes, products, Stripe and CORS settings, so it cannot invent an endpoint that would 404 for your customers. It runs no commands and adds no dependencies — Stripe.js comes in through a plain <script> tag. The GitHub connection uses OAuth, and the token is never written into the repository’s git config. More on the GitHub page.
With your coding assistant connected over MCP
If you write the integration yourself, connect your assistant to the workspace’s MCP server: it reads the exact resource sheet instead of guessing field names.
Going further
- StripeTake store payments into your own Stripe account, company by company.Read
- GitHubPublish a static site from a GitHub repository, or have the store built into your existing site.Read
- Online storeOrders, catalogue, promo codes and shipments handled by your assistant, in test mode by default.Read
- REST API v1Around 135 REST resources, scoped keys, an OpenAPI schema and signed webhooks.Read
Frequently asked questions
Do I need to rebuild my website to sell with Ondes PRO?
No. Your site keeps its stack and design; it calls the Ondes PRO public store for the catalogue, cart and checkout. Ondes PRO handles prices, stock and orders, which you find in Store & Orders.
Why does my site show a CORS error?
Because its origin has not been declared. Add the site’s exact address (scheme and domain, no path) under API & Developers → Allowed origins. Only the workspace superuser can change it.
Can I put my API key in the site’s JavaScript?
No, never. API keys are for server-side code only. The browser uses the public store at /shop/api/, which needs no key and recomputes amounts itself.
Which Stripe account receives the money?
The connected Stripe account of the company selling the products in the cart, or the parent company’s if the subsidiary has not connected one. The shop/commandes/configuration-paiement/ resource tells you which account applies.
How do I test checkout without charging anyone?
Server-side, call /api/v1/test/shop/commandes/: the order is flagged as a test, stays out of every figure and returns a simulated payment page. Test and production webhooks are configured separately.
Can the “Connect my site” agent change my site without my approval?
No. It works on a copy, asks its questions, then presents a diff. Committing and pushing to your repository remain two explicit decisions on your side, and it never force-pushes.
Plug your AI into your business
The MCP server is included in every plan, with no add-on or extra fee.
Read next
- Build an integrationScoped keys, signed webhooks, idempotency and test mode for a back office that never creates duplicates.Read
- Migrate to Ondes PROBring over catalogue, customers and billing records in verified batches, with AI doing the column mapping.Read
- Automate with AIReminders, reports and automations described in one sentence, always reviewed before anything runs.Read