Architecture Overview
Sticker’s embedded integration follows a simple but secure architecture that keeps your users authenticated across both platforms while providing a seamless ordering experience.Integration Components
Backend Integration
Two API endpoints to implement on your backend server
Frontend Embedding
iframe component to display Sticker in your UI
Webhook Listeners
Optional webhooks to receive order status updates
User Management
Automatic provisioning and profile synchronization
Integration Flows
One-Time Setup Flow
This flow happens once when a customer enables the supplies module:1
Customer Enables Module
A customer clicks “Enable Supplies” in your platform
2
Collect Organization Data
Gather organization details and user list from your system
3
Call Organization Setup API
Send organization and user data to Sticker’s API
4
Store Partner Org ID
Save the returned profile ID to link future requests
5
Enable Supplies UI
Show the supplies module option in your platform’s navigation
Per-Session Authentication Flow
This flow happens every time a user opens the supplies module:1
User Clicks Supplies
User navigates to the supplies section in your platform
2
Identify User
Get the current user’s information from your auth system
3
Call Handshake API
Send user details to receive a session token
4
Embed iframe
Display the iframe with the session token in the URL
5
User Shops
User browses, adds to cart, and completes checkout—all within your platform
Integration Methods
Sticker supports two integration methods depending on your platform’s capabilities:Method 1: OAuth-Based Integration (Recommended)
Best for platforms with OAuth capabilities. Sticker automatically syncs organization data. Benefits:- Automatic data synchronization
- Real-time updates to user profiles and addresses
- Reduced maintenance burden
- Better data consistency
- OAuth 2.0 provider endpoint
- User authorization flow
- Token refresh mechanism
Method 2: Manual Data Push
Best for platforms without OAuth. You manually send organization data to Sticker. Benefits:- Simpler to implement
- Full control over data sent
- No OAuth infrastructure required
- Structured organization data
- User list with email addresses
- Address information
Manual data push is perfect for getting started quickly. You can always upgrade to OAuth later.
Data Models
Organization Structure
User Structure
Security Considerations
API Authentication
API Authentication
All API requests require your Partner API Key in the Authorization header. Never expose this key in client-side code.
Request Signing
Request Signing
Handshake requests must be signed with HMAC-SHA256 using your API key to prevent tampering.
Session Tokens
Session Tokens
Session tokens expire after 5 minutes and are single-use only, ensuring each user session is properly authenticated.
iframe Sandboxing
iframe Sandboxing
The embedded iframe runs in a sandboxed environment with limited permissions for security.
Rate Limiting
To ensure system stability, API requests are rate limited:| Endpoint | Rate Limit | Burst |
|---|---|---|
| Organization Setup | 100 requests/hour | 10 concurrent |
| Handshake | 1,000 requests/hour | 100 concurrent |
| Webhooks | N/A (inbound only) | N/A |
Environments
Sticker provides two environments for development and production:Sandbox Environment
For development and testing:- Test credit cards accepted
- No real orders fulfilled
- Unlimited API calls
- Separate database from production
Production Environment
For live customer orders:- Real payment processing
- Actual order fulfillment
- Rate limits enforced
- Production SLA guarantees
Always test your integration thoroughly in sandbox before going to production. Contact support when ready to deploy.
Monitoring & Analytics
Track your integration’s health and usage:API Dashboard
View API call volumes, error rates, and latencies
Order Analytics
Track orders placed through your integration
User Engagement
Monitor active users and session durations
https://partners.sticker.com/dashboard
Support & Resources
API Status
Check real-time API health and uptime
Partner Support
Get help from our integration engineers
Changelog
Stay updated on new features and changes
Community Forum
Connect with other partners

