Exemple complet (de bout en bout)

{
  "manifest": {
    "manifest_version": "2.0",
    "id": "audit-hello",
    "name": "Audit Hello",
    "version": "1.0.0",
    "description": "Démo inspections.",
    "runtime": {
      "type": "external",
      "entry_url": "https://audit-hello.example.com",
      "allowed_origins": ["https://audit-hello.example.com"]
    },
    "permissions": ["app_data:read", "app_data:write"],
    "collections": {
      "inspections": {
        "schema": {
          "type": "object",
          "properties": {
            "title": { "type": "string" },
            "status": { "type": "string", "enum": ["draft", "done"] }
          },
          "required": ["title", "status"],
          "additionalProperties": false
        }
      }
    }
  }
}

TENANT="<espace_client>"
TOKEN="<jeton_admin>"
API="https://api.superfasttt.ai"

# valider (ne modifie rien)
curl -X POST $API/api/v1/app-platform/manifests/validate \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-ID: $TENANT" \
  -H "Content-Type: application/json" -d @manifest-request.json

# importer (enregistre la version)
curl -X POST $API/api/v1/app-platform/manifests/import \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-ID: $TENANT" \
  -H "Content-Type: application/json" -d @manifest-request.json

curl -X POST $API/api/v1/app-platform/apps/audit-hello/install \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-ID: $TENANT"

// lib/sf.ts
const API = process.env.SF_API ?? "https://api.superfasttt.ai";
// Doit être une valeur de runtime.allowed_origins du manifest.
const ORIGIN = process.env.APP_ORIGIN ?? "https://audit-hello.example.com";

export async function exchange(launchToken: string) {
  const r = await fetch(`${API}/api/v1/app-platform/runtime/exchange`, {
    method: "POST",
    // En appel serveur→serveur, le navigateur ne pose pas d'Origin :
    // on le fournit nous-mêmes, sinon 403 origin_required.
    headers: { "Content-Type": "application/json", Origin: ORIGIN },
    body: JSON.stringify({ launch_token: launchToken }),
    cache: "no-store",
  });
  if (!r.ok) throw new Error(`exchange ${r.status}: ${await r.text()}`);
  return r.json() as Promise<{ access_token: string; scopes: string[] }>;
}

export async function listInspections(token: string) {
  const r = await fetch(`${API}/api/v1/app-data/inspections?sort=-created_at`, {
    headers: { Authorization: `Bearer ${token}`, Origin: ORIGIN },
    cache: "no-store",
  });
  if (!r.ok) throw new Error(`list ${r.status}`);
  return r.json();
}

export async function createInspection(
  token: string,
  data: { title: string; status: "draft" | "done" },
) {
  const r = await fetch(`${API}/api/v1/app-data/inspections`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
      Origin: ORIGIN,
    },
    body: JSON.stringify({ data }),
    cache: "no-store",
  });
  if (!r.ok) throw new Error(`create ${r.status}: ${await r.text()}`);
  return r.json();
}

// app/api/launch/route.ts
import { NextRequest, NextResponse } from "next/server";
import { exchange } from "@/lib/sf";

export async function GET(req: NextRequest) {
  const launchToken = req.nextUrl.searchParams.get("launch_token");
  if (!launchToken) {
    return NextResponse.redirect(new URL("/?error=missing_token", req.url));
  }
  try {
    const { access_token } = await exchange(launchToken);
    const res = NextResponse.redirect(new URL("/inspections", req.url));
    res.cookies.set("sf_session", access_token, {
      httpOnly: true,
      secure: true,
      sameSite: "lax",
      path: "/",
      maxAge: 60 * 15, // l'access_token vit ~15 min
    });
    return res;
  } catch (e) {
    const msg = e instanceof Error ? e.message : "exchange_failed";
    return NextResponse.redirect(new URL(`/?error=${encodeURIComponent(msg)}`, req.url));
  }
}

// app/inspections/page.tsx
import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import { createInspection, listInspections } from "@/lib/sf";

async function addInspection(formData: FormData) {
  "use server";
  const token = (await cookies()).get("sf_session")?.value;
  if (!token) redirect("/?error=session_expired");
  await createInspection(token!, {
    title: String(formData.get("title")),
    status: "draft",
  });
  redirect("/inspections");
}

export default async function Page() {
  const token = (await cookies()).get("sf_session")?.value;
  if (!token) redirect("/?error=session_expired");
  const { items } = await listInspections(token!);

  return (
    <main>
      <form action={addInspection}>
        <input name="title" placeholder="Titre" required />
        <button type="submit">Créer</button>
      </form>
      <ul>
        {items.map((r: any) => (
          <li key={r.id}>{r.data.title} — {r.data.status}</li>
        ))}
      </ul>
    </main>
  );
}

curl -X POST $API/api/v1/app-platform/apps/audit-hello/launch-token \
  -H "Authorization: Bearer <jeton_utilisateur>" -H "X-Tenant-ID: $TENANT"
# → { "launch_token": "...", "entry_url": "https://audit-hello.example.com?launch_token=...", "expires_at": "..." }