OpenShelf

Your store. Your infrastructure. Your freedom.

Open-source, single-tenant e-commerce that runs as one Cloudflare Worker with D1.

English · Türkçe

About the Deploy button. The button only works when the repository is public on GitHub. Replace berkayoztunc in the button URL with your GitHub organization or username (for example your fork). Details in Quick start.

Storefront (left) and admin orders page (right), shown with demo data in Mock Mode.

What you need before you start

Only two things are required to deploy. Everything else is optional and can be added later from the admin panel.

1. Required Worker secrets (the Deploy button and pnpm run setup both ask for them):

Name	How to create it	Purpose
APP_ENCRYPTION_KEY	openssl rand -base64 32	Encrypts integration credentials stored in D1. Keep a copy: losing it makes stored keys unreadable.
SETUP_TOKEN	openssl rand -hex 24	One-time token to create the owner account at /admin/setup.

Also needed: a free Cloudflare account and, for the Deploy button, a public GitHub repository.

2. Integration credentials (optional, entered in Admin → Settings → Integrations, stored encrypted, never Worker secrets). Skip them to run in Mock Mode.

Integration	You need from the vendor
iyzico (payments)	API key, Secret key, environment (sandbox or production)
Trendyol Marketplace	Seller (supplier) ID, API key, API secret, environment (production or stage); optional webhook username and password
Geliver (shipping)	API token, sender address ID
Trendyol e-Faturam	Service URL, username, password
Netgsm (SMS)	Usercode, API password, sender header
Twilio (SMS)	Account SID, Auth Token, From number or Messaging Service SID
Cloudflare Email Service	Account ID, API token, default From address
Google Analytics 4	Measurement ID, Measurement Protocol API secret
Meta Pixel / CAPI	Pixel ID, Conversions API access token

Where to find each key: see the integration docs. Use each vendor's sandbox first; nothing here has been verified against a live account yet.

What is OpenShelf

A small merchant can run a real storefront without handing the catalog, customers and orders to a central platform. OpenShelf deploys to your own Cloudflare account as a single Worker that serves the storefront (/), the admin panel (/admin/) and the API (/api/*, /webhooks/*, /media/*, /feeds/*). Data lives in your D1 database. One store per deployment.

Status: early development (v0.1). See Integrations for what has and has not been verified.

Features

• Catalog: products, variants, categories, media, coupons, customers.
• Inventory ledger: append-only stock movements, transactional reservations at checkout (no overselling under concurrency).
• Hosted checkout: card data never touches OpenShelf; server-side pricing; payment confirmed by verified webhook plus server-to-server re-check.
• Channels: own storefront plus Trendyol marketplace sync through the outbox, and a Trendyol API console in the admin (guide).
• Admin settings: store name, logo, banner, brand colors, SEO, legal texts, checkout rules, tracking, notifications, integrations.
• Security: PBKDF2 password hashes, optional TOTP MFA, __Host- session cookies, CSRF + Origin checks, RBAC, audit log, AES-256-GCM encrypted integration secrets, fixed outbound host allowlists, rate limits, optional Turnstile. See docs/security.md.
• Analytics: GA4 and Meta Pixel/Conversions API with consent mode and shared event_id for browser/server deduplication. See docs/tracking.md.
• Notifications: transactional SMS (Netgsm, Twilio) and e-mail (Cloudflare Email Service), editable TR/EN templates. See docs/notifications.md.
• Mock Mode: try the whole shop with no real provider accounts. See docs/mock-mode.md.

Integrations

All adapters are written against vendor documentation and covered by mocks and contract tests. None has been verified against a live account yet. Use each vendor's sandbox first.

Integration	Kind	Docs	Status
iyzico	Payment (hosted form)	iyzico	Implemented, UNVERIFIED live
Geliver	Shipping	Geliver	Implemented, UNVERIFIED live
Trendyol Marketplace	Marketplace sync	Trendyol	Implemented, UNVERIFIED live
Trendyol e-Faturam	Invoicing	e-Faturam	Implemented, UNVERIFIED live
Google Analytics 4	Analytics	GA4	Implemented, UNVERIFIED live
Meta Pixel / CAPI	Ads	Meta	Implemented, UNVERIFIED live
Netgsm	SMS	Netgsm	Implemented, UNVERIFIED live
Twilio	SMS	Twilio	Implemented, UNVERIFIED live
Cloudflare Email Service	E-mail	Cloudflare Email	Implemented, UNVERIFIED live. Beta: arbitrary recipients need Workers Paid; on Free you can only send to verified addresses

Quick start

Three ways, easiest first.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗