Request sensitive data access

Daraz Open Platform provides a security framework to protect the sensitive business data of sellers. By default, these business data are masked according to security evaluation. Sensitive business data include:

• Product information, such as price, stock, and promotion details.
• Order and order item details
• Customer name and contact information
• Financial and transaction statements

To request access to the sensitive business data, you need to go through a review process for your application on Daraz DataMoat, a security module that is integrated with Daraz Open Platform.

Take the following steps to request sensitive data access:
1. From the list of your applications, click Manage to open the overview page of your application.
2. On the App Overview page, you can find the Sensitive Data Privilege field under the Advanced Information section.
3. Click Apply Unmask . The Access to Sensitive Data page on Daraz Datamoat is opened.
4. Follow the instructions on the Access to Sensitive Data page to obtain access to sensitive data for your application. You can also refer to the DataMoat documentation for details.

Reference

For detailed introduction to functions and security review process of Daraz DataMoat, see Daraz DataMoat Documentation .

Configure seller authorization

If your application needs to access Daraz sellers' business data, your application needs to get the authorization from sellers, and you need to guide them to complete the flow of “using Daraz seller account to log in and authorize”.

Authorization strategy

Daraz Open Platform uses OAuth 2.0 protocol for user authentication and provides different authorization strategies for different application categories, which are pre-defined for the application category that your application belongs to. You can view the detailed authorization strategy for your application on the top section of the Auth Management page, including the following information:

• Authorized Policy: The overall strategy for your application
• Access Token Duration: The validity duration of the access token for your application
• Refresh Token Duration: The validity duration of the refresh token (for details, refer to the OAuth Documentation )
• Authorized Page: Whether the authorization page is displayed (Show Auth Page by default)
• Authorized Agreement: The OAuth2.0 authorization type
• Authorized User Limit: The maximum number of sellers who can authorize the application

Important
The following 2 kinds of authorization policy are applied to different APP categories:

• Allow binding user to authorize : This authorization policy applies to the “Seller In-house APP” and “Customer Service” categories. For this policy, only sellers who have been configured in the “Authorized Seller Whitelist” field can authorize your application. Refer to the section below for details.
• Allow login users to authorize : This authorization policy applies to the “ERP System” and other APP categories. For this policy, any Daraz sellers can authorize your application, so you do not need to configure the seller whitelist. You can just send your authorization URL to your sellers for authorization.

Specify seller whitelist

If you develop an application for specific sellers, you can limit the authorization scope by specifying the seller whitelist on Daraz Open Platform, then only these sellers can authorize your application to access their business data in Daraz marketplace. After your application is deployed online, you need to provide the authorization URL to the sellers. When the sellers log in your application for the first time, they will be prompted to complete the authorization process.

Take the following steps to specify the short code of sellers who can authorize your application to access their business data.
1. Open the APP Console and click App Management -> Auth Management.
2. In the Authorization Information section, view the description of the authorization strategy for your application.
3. In the Authorized Seller Whitelist section, enter the seller account in the authorization field. Multiple seller accounts can be separated by semicolons.
4. Click Submit .

Note: If you are a third party developer and your application is open to all Daraz sellers, you only need to provide the URL of your application to the sellers when the application is deployed online. The sellers can follow the URL to complete the authorization process.

Next step

Follow the instructions in this documentation to complete seller authorization: Seller Authorization Introduction .

FAQ