AppBro developer docs

Everything AppBro sets up for your app, and the two small APIs your app can call. Sign in at appbro.biz59.net. Full API reference: appbro.biz59.net/api/docs. Sections 4 to 6 and extra pages come with the paid plan (pricing plans).

1. Store links

The address is <your-app>.b59.link, or your own domain once it's connected. Both keep working.

2. Your own domain

1. At your registrar add an A record for the domain (and www if you want it) with the value 138.197.240.239. Remove other A/AAAA records for those names.
2. In the console, Domain tab, enter the domain and save. When DNS has updated, press "Check DNS again".
3. AppBro issues a Let's Encrypt certificate within a few minutes, and your pages answer at your domain over HTTPS.

3. Pages

Every page is HTML you can edit. For safety, saving removes scripts, iframes, forms, event handlers and javascript: links. The header, footer links and the support / delete-account forms are added for you. Every app has the five standard pages; you can add up to 10 extra pages, and every earlier version of each page is kept.

4. Sign-in for your app's users

Your app signs users in with osec.one, our sign-in service, using your app's appcode (shown in the console):

POST https://api2.osec.one/auth/request-otp
appcode: https://<your-app>.b59.link
{ "email": "user@example.com" }

POST https://api2.osec.one/auth/verify-otp
appcode: https://<your-app>.b59.link
{ "email": "user@example.com", "otp": "123456" }   -> { "token": "..." }

Apple and Google sign-in work through osec.one too. Send the token to AppBro as Authorization: Bearer <token>.

5. Cloud sync

Add collections (like expenses, notes) in the console. Each user only ever sees their own rows. A row is a JSON document up to 64 KB with an id you choose and lu, the time the device changed it.

• The later lu wins; older changes come back in skipped.
• deleted: true is final: a deleted row can't come back.
• Set encrypted: true on rows you encrypt on the device; AppBro stores them as they are.
• Pull pages by a server cursor, so a device with a wrong clock never misses a change. Keep the last cursor and send it next time.

POST https://dbsync.biz59.net/expenses/push
X-AppBro-Key: appbro_app_...            (from the console, Sign-in and sync tab)
Authorization: Bearer <osec.one token>
Content-Type: application/json

{ "rows": [
  { "id": "e1", "data": { "amount": 12, "note": "Taxi" }, "lu": "2026-10-08T10:00:00Z" },
  { "id": "e2", "deleted": true, "lu": "2026-10-08T10:05:00Z" }
] }

-> { "applied": ["e1", "e2"], "skipped": [], "server_time": "..." }

POST https://dbsync.biz59.net/expenses/pull
(same headers)
{ "cursor": null, "limit": 500 }

-> { "rows": [ { "id": "e1", "data": {...}, "lu": "...", "deleted": false, "encrypted": false } ],
     "cursor": "2026-10-08T10:00:01.123456+00:00|e1", "has_more": false }

Also available at https://appbro.biz59.net/api/sync/<collection>/push. GET /api/sync/me returns the signed-in user and the app's collections; POST /api/sync/account/delete removes everything the user synced (wire it to your in-app "delete my account" button).

Your users' own page. An app site with sign-in has a page at /my-data, linked as "My data" in its footer. A user signs in there with the same account as in your app and sees every collection the app synced for them, newest first, page by page, with an Excel download. It is read-only. In the console you see who uses the app and how much each account stores (Sign-in and sync, "See all users"); the rows themselves are only for the user.

6. Content API

FAQ entries, what's new notes, announcements and remote config you edit in the console and your app reads as JSON:

GET https://appbro.biz59.net/api/public/apps/<your-app>/content?kind=faq
-> { "app": "tallyho", "items": [ { "kind": "faq", "title": "Does it work offline?", "body": "Yes...", "data": {} } ] }

7. API for scripts and bots

Sign in with POST /api/auth and your email (a code arrives), then the same call with the code; or with an API key. Send Authorization: Bearer <session_key> to every /api/apps route.

8. Store review

Before you submit, open Store review in the console (or Start a store review on an app's overview). Paste your listing text and links, tick what the app does, add your App Review notes and upload Info.plist, PrivacyInfo.xcprivacy, your entitlements, a lock file (Podfile.lock, Package.resolved, package.json or pubspec.lock) and screenshots. Our reviewer checks them against the App Review Guidelines and Apple's Developer Program License Agreement and writes a report: fixes first, then things to check, each with the rule it comes from, plus what it could and couldn't check. A review usually takes 10 to 30 minutes. The demo login you give is deleted when the review ends.

POST /api/reviews               {"app_id": "<optional>", "name": "...", "description": "...", "privacy_url": "...", "answers": {"accounts": true}}
POST /api/reviews/<id>/files    multipart: kind=info_plist|privacy_manifest|entitlements|dependencies|screenshot, file
POST /api/reviews/<id>/submit
GET  /api/reviews/<id>          -> {"status": "done", "report": {"verdict": "fix_first", "items": [...]}}

AppBro never submits your app or uses TestFlight for you: Apple only accepts uploads from your own account.

← AppBro