NovaTech Beauty Insights Hub

Language

For Developers

Build Faster. Integrate Smarter. Scale Seamlessly.

Whether you're launching a feature-rich e-commerce site, building a virtual try-on experience, or powering a scalable AI engine, our developer-first architecture makes it easy to implement, customize, and deploy powerful AR and AI tools into your digital stack.

What We Offer

Developer-Friendly by Design

We offer flexible, modular solutions that can plug directly into your infrastructure, no heavy lifting required.

RESTful APIs & Webhooks

Pre-built SDKs for web & mobile

Clean, well-documented codebase

Full tech support & integration guides

Seamless Integration with Any Tech Stack

Our platform is built to fit yours. Novagates works across all major environments, frameworks, and CMS platforms, from Shopify and Magento to custom-built systems.

Frontend agnostic

Headless architecture ready

Easy plugin options for CMS & storefronts

Authenticating to the REST APIs

Your backend signs a client_assertion with its ES256 private key and POSTs it to /api/token, receiving a short-lived (5 min) access_token in return. You hand that to your frontend, which appends it to the SDK <script> tag as ?sessionToken=…. The SDK reads it off its own src and attaches it as Authorization: Bearer on every Novagates call.

Keep server-side only

API key (Client ID)
ES256 private key (private JWK)
Signing the client_assertion
POSTing /api/token

Safe to ship to the browser

Short-lived access_token (≤ 5 min) passed as ?sessionToken=…
The SDK <script> tag with sessionToken + module

Refresh by re-fetching from your backend before the 5-minute expiry. Never send the private key or client_assertion to the browser.

Install

# Requires bash, curl, jq.
# Pre-sign client_assertion with one of the language tabs below.

Implementation

CLIENT_ASSERTION="$(node ./scripts/sign-client-assertion.js)"

curl -sS -X POST https://api.novagates.com/api/token \
  -H 'Content-Type: application/json' \
  -d "{
    \"client_assertion\": \"${CLIENT_ASSERTION}\",
    \"client_assertion_type\": \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\"
  }" | jq -r .access_token

POST /api/token — Request & response schema

The only endpoint your backend calls directly. Everything else is invoked by the SDK on your behalf using the sessionToken you embed on its <script> tag.

Request

POST · application/json or application/x-www-form-urlencoded

client_assertion (required) — ES256-signed JWT. Header carries the public jwk (kty/crv/x/y). Payload: iss=sub=[API_KEY], unique jti.
client_assertion_type (required) — must be exactly: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
dpop_jkt (optional) — base64url thumbprint (42–44 chars) of an ephemeral browser key to bind the token to.

Response

200 OK · application/json

access_token — HS256-signed JWT. Claims: sub=[API_KEY], cnf.jkt=bound thumbprint, iss=novagates, unique jti.
token_type — "Bearer"
expires_in — 300 (5 minutes)

Errors: 400 for invalid input, 401 when the header jkt doesn't match the stored [API_KEY] jkt or when the jti has been replayed.

SDK Integration — Web & Mobile

Initialize the SDK by embedding a sessionToken on its <script> tag. Your frontend fetches the token from your backend (which calls /api/token), injects the SDK script tag with ?sessionToken=… and ?module=…, and the SDK reads it off its own src and attaches it as Bearer on every Novagates call.

Init flow

Your frontend fetches a token from your own /api/sdk-token endpoint.
Your backend signs an ES256 client_assertion, exchanges it at POST /api/token for a 5-minute access_token, and returns it as sessionToken.
The frontend injects the SDK <script> tag with ?sessionToken=<token>&module=<module-name>.
The SDK calls Novagates.init({ rootId, productsSource, immediate: true }), reads sessionToken off its own src, and sends it as Authorization: Bearer on every request.
Refresh by re-fetching before the 5-minute expiry (or just reload the page) to avoid 401s.

Implementation

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>Novagates Virtual Try-On</title>
  </head>
  <body>
    <div id="novagates-root"></div>

    <script>
      (async function bootNovagates() {
        // 1. Mint a short-lived sessionToken on YOUR backend.
        const res = await fetch("/api/sdk-token", { credentials: "include" });
        if (!res.ok) throw new Error("Failed to fetch SDK session token");
        const { sessionToken } = await res.json();

        // 2. Inject the SDK loader with sessionToken + module on the URL.
        const params = new URLSearchParams({
          sessionToken: sessionToken,
          module: "virtual-try-on",
        });
        const script = document.createElement("script");
        script.src =
          "https://cdn.novagates.com/sdk/novagates-sdk.js?" + params.toString();
        script.async = true;
        script.onload = function () {
          // 3. Init once the loader has registered the global.
          window.Novagates.init({
            rootId: "novagates-root",
            productsSource: "/api/products.json",
            immediate: true,
          });
        };
        document.body.appendChild(script);
      })();

      // 4. Listen for product events emitted by the SDK.
      window.addEventListener("sdk:addToCart", function (e) {
        console.log("[novagates] add to cart", e.detail);
        // forward to your cart, analytics, etc.
      });
    </script>
  </body>
</html>

Drop-in Plugins

For WordPress / WooCommerce, Magento, Shopify, and OpenCart we ship the full plugin. It handles client_assertion signing, /api/token exchange, sessionToken rotation, and catalog sync for you — no signing keys to manage. Download links and installation instructions live inside your dashboard.

WordPressWooCommerceMagentoShopifyOpenCart

Products Endpoint & Schema

The SDK consumes a JSON catalog conforming to the schema below. The `technologies` field decides which try-on / analysis / 3D pipeline activates per product; `product_types` and `category` drive the UX.

simple

Single SKU, one set of attributes

configurable

Parent SKU exposes variants (shades, sizes)

variable

Variants with independent pricing

// GET /api/products  →  Product[]
//
// Three product shapes, distinguished by `type_id`:
//   "simple"        — single SKU, single set of attributes
//   "configurable"  — parent SKU exposes child variants (size/shade swatches)
//   "variable"      — parent SKU with priced variants (e.g. fragrance volumes)
//
// Every product family below extends this base. Required vs null fields
// depend on the family — see the next tabs.

interface Product {
  /* identity */
  id: number;
  uid: string;
  sku: string;                  // unique merchant SKU
  type_id: "simple" | "configurable" | "variable";
  name: string;
  brand: string | null;
  manufacturer: string | null;
  country_of_manufacture: string | null;
  made_in: string | null;

  /* taxonomy */
  category: string;             // e.g. "Women > Makeup > Face > Foundation"
  product_types: string;        // see family tabs
  product_type_id: string;      // your CMS taxonomy id

  /* commerce */
  url_key: string;
  url_path: string;
  price: { regularPrice: { amount: { currency: string; value: number } } };

  /* media */
  image:        { url: string };
  swatch_image: { url: string };
  thumbnail:    { url: string };
  small_image?: { url: string };

  /* try-on / 3D pipeline switch */
  is_product_try_on: 0 | 1;
  is_product_skin_improvement: 0 | 1;
  asset_url: string | null;     // PNG texture, .glb, or null per family
  technologies: string;         // pipe-separated; activates SDK modules

  /* configurable / variable parents */
  variants?: Array<{ product: Product }>;
}

Join the Dev Community

Novagates isn’t just a platform, it’s a partner.

We support developers every step of the way, with expert onboarding, shared codebases, and a growing developer community.

Demo store

Language

For Developers

Build Faster. Integrate Smarter. Scale Seamlessly.

What We Offer

Developer-Friendly by Design

We offer flexible, modular solutions that can plug directly into your infrastructure, no heavy lifting required.

RESTful APIs & Webhooks

Pre-built SDKs for web & mobile

Clean, well-documented codebase

Full tech support & integration guides

Seamless Integration with Any Tech Stack

Our platform is built to fit yours. Novagates works across all major environments, frameworks, and CMS platforms, from Shopify and Magento to custom-built systems.

Frontend agnostic

Headless architecture ready

Easy plugin options for CMS & storefronts

Authenticating to the REST APIs

Keep server-side only

API key (Client ID)
ES256 private key (private JWK)
Signing the client_assertion
POSTing /api/token

Safe to ship to the browser

Short-lived access_token (≤ 5 min) passed as ?sessionToken=…
The SDK <script> tag with sessionToken + module

Refresh by re-fetching from your backend before the 5-minute expiry. Never send the private key or client_assertion to the browser.

Install

# Requires bash, curl, jq.
# Pre-sign client_assertion with one of the language tabs below.

Implementation

CLIENT_ASSERTION="$(node ./scripts/sign-client-assertion.js)"

curl -sS -X POST https://api.novagates.com/api/token \
  -H 'Content-Type: application/json' \
  -d "{
    \"client_assertion\": \"${CLIENT_ASSERTION}\",
    \"client_assertion_type\": \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\"
  }" | jq -r .access_token

POST /api/token — Request & response schema

The only endpoint your backend calls directly. Everything else is invoked by the SDK on your behalf using the sessionToken you embed on its <script> tag.

Request

POST · application/json or application/x-www-form-urlencoded

client_assertion (required) — ES256-signed JWT. Header carries the public jwk (kty/crv/x/y). Payload: iss=sub=[API_KEY], unique jti.
client_assertion_type (required) — must be exactly: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
dpop_jkt (optional) — base64url thumbprint (42–44 chars) of an ephemeral browser key to bind the token to.

Response

200 OK · application/json

access_token — HS256-signed JWT. Claims: sub=[API_KEY], cnf.jkt=bound thumbprint, iss=novagates, unique jti.
token_type — "Bearer"
expires_in — 300 (5 minutes)

Errors: 400 for invalid input, 401 when the header jkt doesn't match the stored [API_KEY] jkt or when the jti has been replayed.

SDK Integration — Web & Mobile

Init flow

Your frontend fetches a token from your own /api/sdk-token endpoint.
Your backend signs an ES256 client_assertion, exchanges it at POST /api/token for a 5-minute access_token, and returns it as sessionToken.
The frontend injects the SDK <script> tag with ?sessionToken=<token>&module=<module-name>.
The SDK calls Novagates.init({ rootId, productsSource, immediate: true }), reads sessionToken off its own src, and sends it as Authorization: Bearer on every request.
Refresh by re-fetching before the 5-minute expiry (or just reload the page) to avoid 401s.

Implementation

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>Novagates Virtual Try-On</title>
  </head>
  <body>
    <div id="novagates-root"></div>

    <script>
      (async function bootNovagates() {
        // 1. Mint a short-lived sessionToken on YOUR backend.
        const res = await fetch("/api/sdk-token", { credentials: "include" });
        if (!res.ok) throw new Error("Failed to fetch SDK session token");
        const { sessionToken } = await res.json();

        // 2. Inject the SDK loader with sessionToken + module on the URL.
        const params = new URLSearchParams({
          sessionToken: sessionToken,
          module: "virtual-try-on",
        });
        const script = document.createElement("script");
        script.src =
          "https://cdn.novagates.com/sdk/novagates-sdk.js?" + params.toString();
        script.async = true;
        script.onload = function () {
          // 3. Init once the loader has registered the global.
          window.Novagates.init({
            rootId: "novagates-root",
            productsSource: "/api/products.json",
            immediate: true,
          });
        };
        document.body.appendChild(script);
      })();

      // 4. Listen for product events emitted by the SDK.
      window.addEventListener("sdk:addToCart", function (e) {
        console.log("[novagates] add to cart", e.detail);
        // forward to your cart, analytics, etc.
      });
    </script>
  </body>
</html>

Drop-in Plugins

WordPressWooCommerceMagentoShopifyOpenCart

Products Endpoint & Schema

simple

Single SKU, one set of attributes

configurable

Parent SKU exposes variants (shades, sizes)

variable

Variants with independent pricing

// GET /api/products  →  Product[]
//
// Three product shapes, distinguished by `type_id`:
//   "simple"        — single SKU, single set of attributes
//   "configurable"  — parent SKU exposes child variants (size/shade swatches)
//   "variable"      — parent SKU with priced variants (e.g. fragrance volumes)
//
// Every product family below extends this base. Required vs null fields
// depend on the family — see the next tabs.

interface Product {
  /* identity */
  id: number;
  uid: string;
  sku: string;                  // unique merchant SKU
  type_id: "simple" | "configurable" | "variable";
  name: string;
  brand: string | null;
  manufacturer: string | null;
  country_of_manufacture: string | null;
  made_in: string | null;

  /* taxonomy */
  category: string;             // e.g. "Women > Makeup > Face > Foundation"
  product_types: string;        // see family tabs
  product_type_id: string;      // your CMS taxonomy id

  /* commerce */
  url_key: string;
  url_path: string;
  price: { regularPrice: { amount: { currency: string; value: number } } };

  /* media */
  image:        { url: string };
  swatch_image: { url: string };
  thumbnail:    { url: string };
  small_image?: { url: string };

  /* try-on / 3D pipeline switch */
  is_product_try_on: 0 | 1;
  is_product_skin_improvement: 0 | 1;
  asset_url: string | null;     // PNG texture, .glb, or null per family
  technologies: string;         // pipe-separated; activates SDK modules

  /* configurable / variable parents */
  variants?: Array<{ product: Product }>;
}

Join the Dev Community

Novagates isn’t just a platform, it’s a partner.

We support developers every step of the way, with expert onboarding, shared codebases, and a growing developer community.