How to Integrate Lovable with AliExpress API

Go to portals.aliexpress.com and sign in with your AliExpress account. Navigate to the Developer Portal section and click 'Create Application'. Fill in your application name (e.g., 'My Dropshipping Store'), select the application type (typically 'Web Application' for a Lovable storefront), and enter your application's description and website URL. For the API categories, select 'Affiliate' if you want product search and affiliate link generation, or 'Order Management' if you plan to place orders programmatically for dropshipping. Submit the application for review. AliExpress Open Platform review typically takes 1-3 business days. Once approved, your application dashboard will show your App Key (also called App ID) and App Secret. The App Key is a numeric ID and the App Secret is an alphanumeric string. Copy both values — you will need them to authenticate API requests. AliExpress's API uses a signature-based auth system where each API request must include a sign parameter computed by HMAC-MD5 hashing of your App Secret concatenated with all request parameters in alphabetical order.

In your Lovable project, open the Cloud tab by clicking '+' next to the Preview panel, then navigate to the Secrets section. Add two secrets: ALIEXPRESS_APP_KEY with your numeric App Key value, and ALIEXPRESS_APP_SECRET with your App Secret string. These are the only credentials needed for HMAC-MD5 signature generation. Never paste these values into a Lovable chat message or any frontend code — the App Secret must remain server-side because it is used to compute request signatures that authenticate every API call. If someone obtains your App Secret, they can make API calls that count against your rate limits or access your account data. Lovable's security infrastructure actively blocks hardcoded keys and encrypts all secrets with enterprise-grade encryption certified under SOC 2 Type II and ISO 27001:2022 standards. The secret is only accessible from your Edge Functions via Deno.env.get() and is never included in any client-side bundle.

The most critical and technically complex part of AliExpress integration is the request signature. Every AliExpress API call must include a sign parameter that is an HMAC-MD5 hash computed from your App Secret and all request parameters. The signature algorithm is: sort all request parameters alphabetically by key, concatenate them as key+value pairs (no separators), prepend and append the App Secret to the concatenated string, then compute the HMAC-MD5 hash of the result and convert it to uppercase hex. Ask Lovable to create an Edge Function that implements this signature algorithm using Deno's built-in crypto.subtle API (for HMAC-MD5) and proxies requests to the AliExpress API gateway at https://api.taobao.com/router/rest. Required parameters for every request include app_key, method (the API method name), sign_method (set to hmac), timestamp (current UTC time in YYYY-MM-DD HH:MM:SS format), format (json), v (API version, typically 2.0), and sign (the computed signature). For the Affiliate API's product search, the method is aliexpress.affiliate.product.query.

1import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
2
3const corsHeaders = {
4  "Access-Control-Allow-Origin": "*",
5  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
6};
7
8async function hmacMd5(secret: string, message: string): Promise<string> {
9  const encoder = new TextEncoder();
10  const keyData = encoder.encode(secret);
11  const msgData = encoder.encode(message);
12  const cryptoKey = await crypto.subtle.importKey(
13    "raw", keyData, { name: "HMAC", hash: "MD5" }, false, ["sign"]
14  );
15  const signature = await crypto.subtle.sign("HMAC", cryptoKey, msgData);
16  return Array.from(new Uint8Array(signature))
17    .map(b => b.toString(16).padStart(2, "0"))
18    .join("")
19    .toUpperCase();
20}
21
22serve(async (req) => {
23  if (req.method === "OPTIONS") {
24    return new Response("ok", { headers: corsHeaders });
25  }
26
27  try {
28    const appKey = Deno.env.get("ALIEXPRESS_APP_KEY")!;
29    const appSecret = Deno.env.get("ALIEXPRESS_APP_SECRET")!;
30
31    const url = new URL(req.url);
32    const method = url.searchParams.get("method") || "aliexpress.affiliate.product.query";
33
34    const timestamp = new Date().toISOString()
35      .replace("T", " ").substring(0, 19);
36
37    const params: Record<string, string> = {
38      app_key: appKey,
39      format: "json",
40      method,
41      sign_method: "hmac",
42      timestamp,
43      v: "2.0",
44    };
45
46    url.searchParams.forEach((value, key) => {
47      if (key !== "method") params[key] = value;
48    });
49
50    // Generate signature: sort params, concatenate key+value, wrap with secret
51    const sortedKeys = Object.keys(params).sort();
52    const paramString = sortedKeys.map(k => `${k}${params[k]}`).join("");
53    const signInput = `${appSecret}${paramString}${appSecret}`;
54    params.sign = await hmacMd5(appSecret, signInput);
55
56    const queryString = new URLSearchParams(params).toString();
57    const response = await fetch(
58      `https://api.taobao.com/router/rest?${queryString}`
59    );
60    const data = await response.json();
61
62    return new Response(JSON.stringify(data), {
63      headers: { ...corsHeaders, "Content-Type": "application/json" },
64    });
65  } catch (error) {
66    return new Response(
67      JSON.stringify({ error: error.message }),
68      { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
69    );
70  }
71});

With the Edge Function deployed, ask Lovable to create a React component that searches AliExpress products using the Affiliate API. The aliexpress.affiliate.product.query method accepts keywords for search query, category_ids for category filtering, page_no and page_size for pagination, min_sale_price and max_sale_price for price range filtering, and sort for result ordering (SALE_PRICE_ASC, SALE_PRICE_DESC, LAST_VOLUME_DESC for bestsellers). The response contains a list of AliExpress product items with fields including product_id, product_title, sale_price (the current discounted price), original_price (the full price), product_main_image_url (primary product image), evaluate_rate (seller rating), and commission_rate if you are using the affiliate program. Display products as cards with image, title, sale price (formatted with currency), and shipping information. Add a keyword search input and category selector to let users filter the AliExpress catalog.

For a proper dropshipping storefront, you want to import selected AliExpress products into your Supabase database with your own pricing markup rather than displaying AliExpress prices directly to customers. This separates your storefront data from real-time AliExpress availability and lets you control product presentation. When a merchant clicks 'Import' on a product search result, save the product to a Supabase products table with: aliexpress_product_id, title, description, product_images (array of image URLs), aliexpress_cost (the AliExpress sale price), retail_price (your markup — typically 2x-3x cost), shipping_cost, and any relevant variants. Display imported products on your customer-facing storefront using data from Supabase, not from live AliExpress API calls. Only call AliExpress API again when you need to check current pricing before placing a dropshipping order to ensure the cost has not increased. For order fulfillment, collect payment from the customer via Stripe at your retail price, then use the AliExpress Order API (requires separate API approval) to place the dropshipping order at the AliExpress wholesale price.