AliExpress API

Go to developers.aliexpress.com and sign in with an AliExpress account (or create one — AliExpress accounts are free). Navigate to 'My Apps' → 'Create App.' Fill in the app details: - **App Name**: your Bubble app's name - **App Category**: select 'AliExpress Affiliate' for the product search path, or 'AliExpress DS' (dropshipping) for order management - **App Description**: describe your use case After creating the app, you receive an **App Key** (also called App ID) and **App Secret**. Copy both. The App Key is public — it is included as a parameter in every API call. The App Secret is private — it is used only for signing and must NEVER appear in Bubble's API Connector or any frontend code. For the Affiliate product search, go to the AliExpress Affiliate program at portals.aliexpress.com and find your **Tracking ID** (also called Publisher ID or Affiliate ID). This is a required parameter in the affiliate product query method — missing it returns empty results without any error message. For Order Management API access: in your app's dashboard, navigate to 'API Categories' and apply for 'Trade Order' access. AliExpress reviews the application and approves within 1-3 business days. Do not start building the order integration until approval is confirmed — testing against a non-approved category returns a permission error that is unrelated to your code.

1// AliExpress Open Platform credentials:
2// App Key (public):    12345678
3// App Secret (PRIVATE): abc123xyz456secret789   ← NEVER put in Bubble
4// Tracking ID (affiliate): affiliate_ID_here
5
6// AliExpress API gateway URLs:
7// Southeast Asia (default): https://api-sg.aliexpress.com/rest
8// EU alternative:           https://api-eu.aliexpress.com/rest (if applicable)
9
10// How the signing works (conceptual — will be implemented in Cloudflare Worker):
11// 1. Collect all request parameters including app_key, timestamp, method, etc.
12// 2. Sort parameter names alphabetically
13// 3. Concatenate: APP_SECRET + key1value1key2value2... + APP_SECRET
14// 4. HMAC-MD5 the concatenated string using APP_SECRET as key
15// 5. Uppercase the hex result → this is the 'sign' parameter
16
17// Example unsigned call parameters:
18// method=aliexpress.affiliate.product.query
19// app_key=12345678
20// timestamp=2026-01-27 14:32:00
21// sign_method=hmac
22// keywords=wireless+headphones
23// page_no=1
24// page_size=20
25// tracking_id=your_affiliate_id

The Cloudflare Worker is the technical core of this integration. It receives unsigned requests from Bubble, adds the HMAC-MD5 signature, and forwards to AliExpress. Set up is free on Cloudflare's free tier. **Step 1 — Create the Worker.** Go to dash.cloudflare.com → Workers & Pages → Create application → Create Worker. Name it `aliexpress-proxy` and click 'Deploy.' **Step 2 — Add your App Secret as an environment variable.** In the Worker settings, go to Settings → Variables → Add variable. Name: `ALIEXPRESS_APP_SECRET`, Value: your App Secret. Click 'Save and Deploy.' This stores the secret in Cloudflare's secure environment — it never appears in the Worker code and is never accessible to Bubble. **Step 3 — Write the Worker code.** In the Worker editor, replace the default code with the signing proxy implementation below. The Worker: - Receives a GET request from Bubble with parameters (method, keywords, etc.) - Adds required AliExpress parameters: app_key, timestamp, sign_method - Reads App Secret from environment variables - Sorts all parameters alphabetically, concatenates as key+value pairs with App Secret as prefix and suffix - Computes HMAC-SHA256 (or MD5) — AliExpress accepts both for Affiliate API - Appends the `sign` parameter to the AliExpress request - Forwards to `https://api-sg.aliexpress.com/rest` - Returns the response to Bubble **Step 4 — Add CORS headers.** Bubble calls your Worker from its server-side environment, so CORS is not strictly required. But add `Access-Control-Allow-Origin: *` headers to the Worker response for compatibility with any client-side Bubble testing. After deploying, your Worker URL will be `https://aliexpress-proxy.YOUR_SUBDOMAIN.workers.dev`. This is the URL you enter in Bubble's API Connector — not the AliExpress URL directly.

1// Cloudflare Worker: aliexpress-proxy
2// Paste this as the Worker script in the Cloudflare editor
3
4export default {
5  async fetch(request, env) {
6    const url = new URL(request.url);
7    const params = Object.fromEntries(url.searchParams);
8
9    // Add required AliExpress parameters
10    params.app_key = env.ALIEXPRESS_APP_KEY || '12345678'; // your App Key (public)
11    params.timestamp = new Date().toISOString()
12      .replace('T', ' ')
13      .substring(0, 19);  // 'YYYY-MM-DD HH:mm:ss'
14    params.sign_method = 'sha256';
15    params.format = 'json';
16
17    // Sort params alphabetically and concatenate
18    const sortedKeys = Object.keys(params).sort();
19    const toSign = sortedKeys.map(k => `${k}${params[k]}`).join('');
20
21    // Compute HMAC-SHA256 signature
22    const appSecret = env.ALIEXPRESS_APP_SECRET;
23    const encoder = new TextEncoder();
24    const keyData = encoder.encode(appSecret);
25    const messageData = encoder.encode(appSecret + toSign + appSecret);
26
27    const cryptoKey = await crypto.subtle.importKey(
28      'raw', keyData,
29      { name: 'HMAC', hash: 'SHA-256' },
30      false, ['sign']
31    );
32    const signature = await crypto.subtle.sign('HMAC', cryptoKey, messageData);
33    const signHex = [...new Uint8Array(signature)]
34      .map(b => b.toString(16).padStart(2, '0'))
35      .join('')
36      .toUpperCase();
37
38    params.sign = signHex;
39
40    // Build AliExpress request URL
41    const aliexpressUrl = new URL('https://api-sg.aliexpress.com/rest');
42    Object.entries(params).forEach(([k, v]) => aliexpressUrl.searchParams.set(k, v));
43
44    // Forward to AliExpress
45    const response = await fetch(aliexpressUrl.toString(), {
46      method: 'POST',  // AliExpress REST API uses POST for most methods
47      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
48      body: new URLSearchParams(params).toString()
49    });
50
51    const data = await response.json();
52
53    return new Response(JSON.stringify(data), {
54      headers: {
55        'Content-Type': 'application/json',
56        'Access-Control-Allow-Origin': '*'
57      }
58    });
59  }
60};

With the Worker deployed, configure Bubble to use it. In your Bubble editor, go to Plugins → API Connector. Click 'Add another API' and name it 'AliExpress Proxy.' Set the base URL to your Cloudflare Worker URL: `https://aliexpress-proxy.YOUR_SUBDOMAIN.workers.dev`. No trailing slash. No authentication headers are needed for the Worker connection — the Worker itself handles authentication with AliExpress. However, if you want to add a basic API key to your Worker (to prevent unauthorized use of your proxy), add a header `X-Proxy-Key: YOUR_PROXY_SECRET` in Bubble and check the Private checkbox, then verify this header in the Worker code before forwarding. Add the Initialize Call for product search. Click 'Add another call' and name it 'Search Products.' Set method POST (AliExpress REST API uses POST for method-based calls). Set URL to `/` (empty path — all parameters are in the body or query). Set body type to 'Form urlencoded' or use URL parameters — the Worker accepts both since it reads `url.searchParams`. Add parameters: - `method`: `aliexpress.affiliate.product.query` (text, can be static) - `keywords`: `wireless headphones` (text, dynamic) - `page_no`: `1` (text, dynamic) - `page_size`: `20` (text, static) - `tracking_id`: `YOUR_AFFILIATE_TRACKING_ID` (text, static) - `fields`: `productId,productTitle,salePrice,productMainImageUrl,evaluateRate,lastestVolume,affiliateLink` (text, static — limits response fields) Click Initialize call. The Worker signs the request and returns AliExpress's product search response. Bubble detects the deeply nested response fields.

1// Bubble API Connector: AliExpress Proxy
2// Base URL: https://aliexpress-proxy.YOUR_SUBDOMAIN.workers.dev
3//
4// No authentication headers required
5// (optional: X-Proxy-Key for proxy security, mark Private)
6//
7// Initialize Call: POST /
8// Parameters (passed to Worker as query params or form body):
9// method:      aliexpress.affiliate.product.query
10// keywords:    <dynamic: search keyword input>
11// page_no:     1   (dynamic for pagination)
12// page_size:   20
13// tracking_id: YOUR_AFFILIATE_TRACKING_ID
14// fields:      productId,productTitle,salePrice,productMainImageUrl,evaluateRate,lastestVolume,affiliateLink
15//
16// AliExpress response structure (DEEPLY nested):
17// {
18//   "aliexpress_affiliate_product_query_response": {
19//     "resp_result": {
20//       "resp_code": 200,
21//       "resp_msg": "查询成功",
22//       "result": {
23//         "current_page_no": 1,
24//         "current_record_count": 20,
25//         "total_record_count": 4823,
26//         "products": {
27//           "product": [
28//             {
29//               "product_id": 1005004590816226,
30//               "product_title": "Wireless Bluetooth Headphones...",
31//               "sale_price": "USD 12.99",
32//               "product_main_image_url": "https://ae01.alicdn.com/...",
33//               "evaluate_rate": "96.5%",
34//               "lastest_volume": 3842,
35//               "promotion_link": "https://s.click.aliexpress.com/..."
36//             }
37//           ]
38//         }
39//       }
40//     }
41//   }
42// }

With the proxy call initialized, build the product search interface and catalog import workflow in Bubble. **Product search display:** Add an Input element for the search keyword. Add a Repeating Group. Set the Repeating Group's data source to the API Connector call 'AliExpress Proxy → Search Products,' with `keywords` bound to the Input element's value. In each Repeating Group cell, add: - An Image element with Source URL bound to `current cell's product_main_image_url` - A Text element bound to `current cell's product_title` - A Text element bound to `current cell's sale_price` - A Text element bound to `current cell's evaluate_rate` (seller rating, e.g. '96.5%') - A Text element bound to `current cell's lastest_volume` (recent sales count — an indicator of product demand) For **pagination**: bind `page_no` to a number state variable `ali_page` (default 1). Add Next/Previous buttons that increment/decrement the state. **Catalog import:** Add an 'Import Product' button in each Repeating Group cell. When clicked, trigger a workflow: 1. Create a new 'AliProduct' Data Thing (create this data type first in the Data tab) with fields: ali_product_id (text), title (text), price (text), image_url (text), affiliate_link (text), rating (text), sales_volume (number), imported_at (date) 2. Set field values from the current cell's API response data 3. Show a confirmation message This imports AliExpress products into your Bubble database for display in your customer-facing storefront — customers browse the imported catalog, not the live AliExpress API, keeping your storefront fast and reducing proxy calls.

1// AliProduct Data Thing fields (create in Bubble Data tab):
2// ali_product_id  (text)
3// title           (text)
4// price           (text)
5// image_url       (text)
6// affiliate_link  (text)
7// rating          (text)
8// sales_volume    (number)
9// category        (text)
10// supplier_url    (text)
11// imported_at     (date)
12// is_active       (yes/no, default yes)
13
14// Workflow: Import AliExpress product to Bubble
15// Trigger: Button 'Import' clicked in Repeating Group cell
16// Action: Create a new AliProduct
17//   ali_product_id = current cell's product_id (convert to text)
18//   title          = current cell's product_title
19//   price          = current cell's sale_price
20//   image_url      = current cell's product_main_image_url
21//   affiliate_link = current cell's promotion_link (or affiliate_link)
22//   rating         = current cell's evaluate_rate
23//   sales_volume   = current cell's lastest_volume (convert to number)
24//   imported_at    = Current date/time
25
26// AliExpress order status codes (for order management API):
27// FINISH                    = Completed
28// WAIT_BUYER_ACCEPT_GOODS   = Awaiting delivery confirmation
29// IN_ISSUE                  = Dispute open
30// RISK_CONTROL              = Under risk review
31// WAIT_SELLER_SEND_GOODS    = Awaiting shipment
32// FUND_PROCESSING           = Payment processing

The AliExpress Order Management API requires a **user access token** — the `session` parameter — in addition to the app-level signature. This is because order data belongs to a specific AliExpress seller account that must authorize your app. This path requires AliExpress Order API category approval and a Bubble paid plan. **OAuth flow overview:** 1. Your Bubble app redirects the seller to AliExpress's OAuth consent URL 2. The seller authorizes your app and AliExpress redirects to your callback page with a `code` parameter 3. Your Bubble Backend Workflow exchanges the code for an `access_token` and `refresh_token` 4. The access token becomes the `session` parameter in subsequent Order API calls (alongside the HMAC signature) This session token is valid for a period set by AliExpress — check current TTL in the AliExpress developer documentation. The refresh flow uses the `aliexpress.account.token.refresh` API method. Build the consent flow: 1. Create a 'Connect AliExpress' button that triggers a 'Go to external website' action pointing to the AliExpress OAuth URL: `https://oauth.aliexpress.com/authorize?response_type=code&client_id={AppKey}&redirect_uri={YourCallbackURL}&state=random_string` 2. Create a Bubble page at your callback path (e.g., `/aliexpress-callback`). On page load, read the `code` URL parameter. 3. In a Backend Workflow, exchange the code for tokens: call the Cloudflare Worker with `method=aliexpress.system.oauth.token` and `code={code}&redirect_uri={callbackURL}`. The Worker signs and forwards; AliExpress returns `access_token`, `refresh_token`, and `expire_time`. 4. Store the access token in a Bubble Data Thing (AliexpressSession) with the seller's ID and expiry. Use Privacy rules to restrict access. 5. For subsequent Order API calls, pass `session` as an additional parameter to the Cloudflare Worker — the Worker adds it to the AliExpress request alongside the signature. RapidDev's team has experience building OAuth flows for international marketplace APIs. For the full AliExpress seller integration with order automation, reach out at rapidevelopers.com/contact for a scoping call.

1// AliExpress OAuth consent URL:
2https://oauth.aliexpress.com/authorize
3  ?response_type=code
4  &client_id={YOUR_APP_KEY}
5  &redirect_uri=https://yourapp.bubbleapps.io/aliexpress-callback
6  &state=random_state_string
7
8// Token exchange (via Cloudflare Worker → AliExpress):
9// Bubble calls Worker with:
10// method=aliexpress.system.oauth.token
11// code={authorization_code_from_URL}
12// redirect_uri=https://yourapp.bubbleapps.io/aliexpress-callback
13//
14// AliExpress returns:
15// { "access_token": "5000...abc", "refresh_token": "6000...xyz", "expire_time": "2026-04-10 14:32:00" }
16
17// Order management API call (with session):
18// Bubble calls Worker with:
19// method=aliexpress.trade.order.get
20// session={stored access_token}
21// page_no=1
22// page_size=20
23//
24// Order status filtering:
25// order_status=WAIT_SELLER_SEND_GOODS  (awaiting shipment)
26// or: order_status=FINISH              (completed)
27
28// AliExpressSession Data Thing:
29// access_token   (text)
30// refresh_token  (text)
31// expire_time    (date)
32// seller_id      (text)
33// store_name     (text)

Before going live, validate the full integration and set up error handling. **Verify the Cloudflare Worker:** Open the Worker's real-time log viewer in Cloudflare Dashboard → Workers → aliexpress-proxy → Logs. Click 'Begin log stream.' Then trigger a product search from Bubble. You should see the Worker log an incoming request, the signing computation, and the forwarded AliExpress request. Any signing errors appear here before they reach Bubble. **Handle 'sign check failure' errors:** AliExpress returns `"error_response": { "code": 27, "msg": "Invalid Session" }` or `"code": 15, "msg": "sign check failure"` when signing is wrong. Common causes: - Parameters modified after signing (the Worker signs, then Bubble adds extra params) - Timestamp format mismatch (must be `YYYY-MM-DD HH:mm:ss` in AliExpress's timezone) - App Secret with a leading/trailing space in the Cloudflare environment variable **Handle missing tracking_id:** AliExpress Affiliate product search returns an empty `product` array (not an error) when the `tracking_id` is missing or invalid. Bubble displays an empty Repeating Group. Add an 'Only when' condition to the search workflow that checks the search results count before running import actions. **Monitor Workload Units:** Each API call to your Cloudflare Worker proxy consumes WU in Bubble. Product search calls with large result sets and deep nesting are WU-intensive. Cache imported products in the AliProduct Data Thing rather than calling AliExpress on every customer page load — your customer storefront should browse the Bubble database, not make live AliExpress API calls for each visitor. **Cloudflare Worker request limits:** The free tier allows 100,000 Worker invocations per day. For a busy dropshipping research tool, track usage in Cloudflare Dashboard → Workers → Analytics. If you approach the limit, consider caching AliExpress responses in the Worker using Cloudflare Cache API or KV storage.

1// AliExpress error response structure:
2// { "error_response": { "code": 27, "msg": "Invalid Session" } }
3// { "error_response": { "code": 15, "msg": "sign check failure" } }
4// { "error_response": { "code": 50, "msg": "Remote service error" } }
5
6// In Bubble API Connector:
7// Check the Initialize call response for error_response field
8// Add an error handling state in your Bubble page:
9// If API result's error_response is not empty → display error message
10
11// Cloudflare Worker: add response caching for popular searches
12// Add to Worker code before forwarding to AliExpress:
13const cacheKey = new Request(aliexpressUrl.toString());
14const cache = caches.default;
15let cachedResponse = await cache.match(cacheKey);
16if (cachedResponse) { return cachedResponse; }
17// ... forward to AliExpress ...
18// After response:
19const freshResponse = new Response(JSON.stringify(data), { headers: {...} });
20freshResponse.headers.set('Cache-Control', 'max-age=3600'); // cache 1 hour
21await cache.put(cacheKey, freshResponse.clone());
22return freshResponse;
23
24// Bubble WU-saving pattern:
25// Product searches from your TEAM → hit live AliExpress API via Worker
26// Customer storefront browsing → read from AliProduct Data Thing (no API call)
27// Scheduled resync → update AliProduct records nightly via Backend Workflow