Official APIs only
No scraping, no patching the core. Integrations use APIs and extensions supported by each platform.
Your store stays updatable.Five platforms · guided beta
Connect your current store to AI assistants.
Choose your platform and see the actual connection steps. For example, Shopify uses authorization from the dashboard; other platforms need a module or guided setup. Each listing shows what works now and what is still being tested.
Credentials are encrypted at rest with AES-256-GCM and permanently deleted when you disconnect the store.
How we integrate
Three rules we don't break on any platform.
The smallest scope possible
We request catalog and inventory read, and, when closing an operation requires it, checkout write. Catalog sync does not need to query your customer base, and does not. Checkout and post-sale operations DO process the buyer data required to carry them out (shipping address, order data) under the permissions granted and the data processing agreement; in the evidence record they are stored as HMACs, not in the clear. See /en/privacy.
Less permission, less surface.Reversible in one click
Disconnecting a store cascades deletion of normalized catalog, categories, protocols, sync logs, and encrypted credentials.
No soft delete: real delete.
Supported platforms
Every platform, with its own method and its limits.
This isn't a list of logos: it's what has to happen on each platform, with the supported versions and what we don't cover yet.
Shopify
OAuth connection from the dashboard. No module to install, no theme changes.
- Authorize the appFrom the Trusteed dashboard, click Connect store → Shopify. The OAuth flow returns you authorized.
- Review the scopesOnly catalog and inventory read, plus checkout write. We don't request access to customer data.
- Confirm the syncYour catalog appears in the dashboard and the store is exposed as an MCP server.
We do not access end-customer data. The OAuth token is encrypted at rest with AES-256-GCM.
WooCommerce
Two paths: REST keys straight from WooCommerce, or the WordPress plugin if you want the storefront bridge.
- Generate the REST keysWooCommerce → Settings → Advanced → REST API → Add key. Read permissions for the catalog.
- Connect in the dashboardPaste the store URL, consumer key, and consumer secret. We validate connectivity before saving.
- Install the plugin for the storefront bridgeAdds the manifest at /.well-known/mcp.json and the WebMCP bridge on the storefront.
We do not store end-buyer data coming from catalog sync.
PrestaShop
Integration via the native Webservice, read-only. No need to install the module to start.
- Enable the WebserviceAdvanced Parameters → Webservice → Enable Webservice → Save.
- Create the Webservice accountAdd a new account, an auto-generated 32+ character key. Check only GET on products, categories, shops, and configurations. Don't enable POST, PUT, or DELETE.
- Connect in the dashboardStore URL over HTTPS without the /admin suffix, your email, and the key. HTTP Basic auth against the API.
PrestaShop has no native webhooks: the catalog is synced by polling (the automatic sweep runs every 15 minutes by default, `AUTO_SYNC_INTERVAL_MS`) and order status changes and credit slips DO reach us as they happen, pushed by the Trusteed module itself once installed. We validate the URL against SSRF: private IPs, localhost, link-local, and cloud metadata endpoints are rejected.
Magento 2
Two independent modules: the webhook and manifest publisher, and a TrustReceipt verifier that works without reaching our backend.
- Install the modulecomposer require trusteed/agentic-commerce-magento, then bin/magento module:enable Trusteed_AgenticCommerce and setup:upgrade.
- Check the web serverbin/magento trusteed:check-webserver detects Nginx, Apache, or Adobe Commerce Cloud and gives you the exact snippet to serve /.well-known/mcp.json.
- Complete the wizardStores → Configuration → Trusteed → Setup Wizard: API URL, merchant ID, a token scoped to magento:store:write, and store view selection.
Trust Verifier: independent module
A second module, trusteed/trust-verifier-for-magento, verifies TrustReceipts without needing our backend to be reachable. It installs on its own and adds the Stores → Trust Receipts → Verify view, where you paste a JWS and get a verdict. The JWKS is cached for an hour and the conformance suite ships inside the package.
Master and admin tokens are rejected by design: you need to create a dedicated integration token. On Hyvä Theme and PWA Studio, the storefront WebMCP bridge is automatically disabled; server-to-server access keeps working. Magento 2.4.6 and earlier are not supported (PHP 8.1 out of support).
Odoo
Connector with an embedded panel inside Odoo, including the TrustReceipts view. In validation with pilot merchants.
- Request pilot accessThe Odoo connector is in Sandbox: we onboard you together to validate your specific setup.
- Install the embedded panelIt appears inside Odoo's Apps panel, with the TrustReceipt verification view built in.
- Validate against your catalogWe check sync and order flow before exposing sensitive actions.
Sandbox means the connector works but its coverage isn't closed yet. We don't call it Live until it is.
Open source
The modules are downloaded from the repository.
The WordPress, PrestaShop, and Magento modules live on GitHub. You can clone the repo or download the ZIP and install it through your platform's module manager, no marketplace required.
WooCommerce®, PrestaShop®, and Odoo® are registered trademarks of their respective owners. Trusteed is not affiliated with or sponsored by any of these companies.