Salla Live Testing

The live gate: exercise the app as a merchant on a real demo store before calling it done. Green endpoint/MCP tests are not proof — the merchant-facing integration can still be broken.

Demo data only. Test on demo stores using non-sensitive data. Keep production secrets, OAuth/access/refresh tokens, webhook signing secrets, and real customer PII out of third-party capture/inspection tools (request-bin endpoints, screen-share, chat). If a test points config at a temporary receiver, restore the real webhook_url, redirect URLs, and secrets afterward.

Step 0 — Point configured URLs at the deployed domain

Before installing, fetch the configured URLs (salla_apps action=get) — webhook_url, OAuth redirect/callback, embedded-page URL — and confirm each points at the domain where the app actually runs. They must match: a mismatched URL fails silently (OAuth redirects nowhere, webhooks 404 at the old host, the iframe won't load, no error shown). Align the URLs (or the deployment) before generating install links.