Skip to main content
Sprytto
← Docs

Documentation

Connecting Tebex

Bind one workspace to its Tebex Headless store while keeping provider credentials and checkout authority on the server.

Updated: 24 September 2026

Before you start

Use credentials created for the intended Tebex store. The public token identifies the Headless store, while private and webhook secrets remain server-only capabilities.

Only a workspace owner should create or replace the binding. A support grant never authorizes Sprytto staff to ask for a secret in chat or email.

  • Confirm the Tebex store ID and the environment you are connecting.
  • Prepare a Headless public token and private key with the required scope.
  • Create the webhook endpoint in Tebex and copy its signing secret through the protected form.

Create the binding

Open Dashboard → Integrations → Tebex. The browser submits the credential once over the authenticated same-origin boundary; the server encrypts it before persistence and never returns it again.

  1. Enter the store ID and credentials, then save the connection.
  2. Run a read-only catalogue sync and compare package names, currencies and availability with Tebex.
  3. Send the Tebex endpoint test event and confirm that its signature is accepted exactly once.
  4. Open a public package page and verify that checkout redirects only to the provider URL returned by Tebex.

Authority and rotation

Tebex remains authoritative for package eligibility, price, tax, basket totals, payment and refund state. Sprytto records verified webhook evidence and never treats a browser success page as payment proof.

  • Rotate a suspected credential at Tebex first, then replace the encrypted workspace binding.
  • Keep the bounded previous webhook generation only for the planned transition window.
  • Re-run sync and a signed test event after rotation; do not log or screenshot secret values.