Official APIs only
No scraping, no patching the core. Integrations use APIs and extensions supported by each platform.
Your store stays updatable.Five platforms · guided beta
We connect to what you already have. Not to what you should have.
Trusteed uses official APIs and, where needed, platform-specific modules. Your backend stays the system of record; capabilities are enabled in a guided way and coverage varies by connector.
Credentials are encrypted at rest with AES-256-GCM and permanently deleted when you disconnect the store.
How we integrate
Three rules we don't break on any platform.
The smallest scope possible
We request catalog and inventory read, and, when closing an operation requires it, checkout write. Never access to end-customer data.
Less permission, less surface.Reversible in one click
Disconnecting a store cascades deletion of normalized catalog, categories, protocols, sync logs, and encrypted credentials.
No soft delete: real delete.
Supported platforms
Every platform, with its own method and its limits.
This isn't a list of logos: it's what has to happen on each platform, with the supported versions and what we don't cover yet.
Shopify
OAuth connection from the dashboard. No module to install, no theme changes.
- Authorize the appFrom the Trusteed dashboard, click Connect store → Shopify. The OAuth flow returns you authorized.
- Review the scopesOnly catalog and inventory read, plus checkout write. We don't request access to customer data.
- Confirm the syncYour catalog appears in the dashboard and the store is exposed as an MCP server.
We do not access end-customer data. The OAuth token is encrypted at rest with AES-256-GCM.
WooCommerce
Two paths: REST keys straight from WooCommerce, or the WordPress plugin if you want the storefront bridge.
- Generate the REST keysWooCommerce → Settings → Advanced → REST API → Add key. Read permissions for the catalog.
- Connect in the dashboardPaste the store URL, consumer key, and consumer secret. We validate connectivity before saving.
- Install the plugin for the storefront bridgeAdds the manifest at /.well-known/mcp.json and the WebMCP bridge on the storefront.
We do not store end-buyer data coming from catalog sync.
PrestaShop
Integration via the native Webservice, read-only. No need to install the module to start.
- Enable the WebserviceAdvanced Parameters → Webservice → Enable Webservice → Save.
- Create the Webservice accountAdd a new account, an auto-generated 32+ character key. Check only GET on products, categories, shops, and configurations. Don't enable POST, PUT, or DELETE.
- Connect in the dashboardStore URL over HTTPS without the /admin suffix, your email, and the key. HTTP Basic auth against the API.
Syncs every 6 hours. Real-time webhooks planned for v2. We validate the URL against SSRF: private IPs, localhost, link-local, and cloud metadata endpoints are rejected.
Magento 2
Two independent modules: the webhook and manifest publisher, and a TrustReceipt verifier that works without reaching our backend.
- Install the modulecomposer require trusteed/agentic-commerce-magento, then bin/magento module:enable Trusteed_AgenticCommerce and setup:upgrade.
- Check the web serverbin/magento trusteed:check-webserver detects Nginx, Apache, or Adobe Commerce Cloud and gives you the exact snippet to serve /.well-known/mcp.json.
- Complete the wizardStores → Configuration → Trusteed → Setup Wizard: API URL, merchant ID, a token scoped to magento:store:write, and store view selection.
Trust Verifier - independent module
A second module, trusteed/trust-verifier-for-magento, verifies TrustReceipts without needing our backend to be reachable. It installs on its own and adds the Stores → Trust Receipts → Verify view, where you paste a JWS and get a verdict. The JWKS is cached for an hour and the conformance suite ships inside the package.
Master and admin tokens are rejected by design: you need to create a dedicated integration token. On Hyvä Theme and PWA Studio, the storefront WebMCP bridge is automatically disabled; server-to-server access keeps working. Magento 2.4.6 and earlier are not supported (PHP 8.1 out of support).
Odoo
Connector with an embedded panel inside Odoo, including the TrustReceipts view. In validation with pilot merchants.
- Request pilot accessThe Odoo connector is in Sandbox: we onboard you together to validate your specific setup.
- Install the embedded panelIt appears inside Odoo's Apps panel, with the TrustReceipt verification view built in.
- Validate against your catalogWe check sync and order flow before exposing sensitive actions.
Sandbox means the connector works but its coverage isn't closed yet. We don't call it Live until it is.
Open source
The modules are downloaded from the repository.
The WordPress, PrestaShop, and Magento modules live on GitHub. You can clone the repo or download the ZIP and install it through your platform's module manager, no marketplace required.
WooCommerce®, PrestaShop®, and Odoo® are registered trademarks of their respective owners. Trusteed is not affiliated with or sponsored by any of these companies.