Developing Bitrix24 Marketplace Applications: OAuth, REST, Webhooks

Imagine you have developed an application for Bitrix24, passed moderation, and published it on the marketplace. A week later, complaints arrive — half of the clients have broken synchronization, and the application returns 403 on crm.deal.list. Turns out the 'Basic' plan does not grant CRM permissions, and you did not include a check. Or a webhook stops responding — the handler got unbound, data lost. These scenarios are consequences of typical mistakes that can be avoided during the architecture phase. The problem is that standard templates and unchecked errors are the main reasons for moderation rejections and client loss.

We have implemented over 50 custom Bitrix24 applications for the marketplace over 5 years — from simple widgets to multi-tenant Bitrix24 solutions. We know how to create a stable product that won't let clients down. We specialize in designing robust applications that pass moderation on the first try. Our experience helps avoid pitfalls related to tariff restrictions and error handling. Development cost starts at $3,000 for a simple widget and can go up to $15,000 for complex multi-tenant solutions. The investment pays off through savings on support and rework — typically reducing support time by 40% and handling over 10,000 webhooks per hour with proper async processing.

What Types of Applications Are There?

Embedded applications work in an iframe via the placement API. Placement points: CRM_LEAD_DETAIL_TAB, TASKS_TASK_VIEW_TAB, CALL_LIST, and dozens of others. Widgets are embedded via BX24.placement.call() for small actions: a button in a card, a panel in chat. Applications with a custom interface open in a separate tab — more UX freedom, but the user leaves the context. Bots and chat applications use imbot.* and imsetting.* methods and have their own handler.

Comparison:

OAuth 2.0 in Bitrix24 Applications

Authorization uses OAuth 2.0 with authorization code. Flow:

1. User installs the application → redirect to redirect_uri with code.
2. Application exchanges code for access_token and refresh_token via https://oauth.bitrix.info/oauth/token/.
3. access_token lives 1 hour, refresh_token lives 180 days.
4. Tokens are stored in your DB, tied to member_id.

For server-to-server, use grant_type=client_credentials — available for 'Application' type apps. member_id is critical: all data in the DB is partitioned by it, otherwise one company's data might leak to another.

Official Bitrix24 REST API OAuth documentation

Bitrix24 REST API: Working with Data

The Bitrix24 REST API is not classical REST. Methods are called via POST to https://{portal}.bitrix24.ru/rest/{method} with form-data or JSON. Pagination uses start, limit of 50 records. To get all, loop with next.

Popular groups:

• crm.lead., crm.deal., crm.contact., crm.company. — CRM
• tasks.task.*, task.item.list — tasks
• disk.folder., disk.file. — files
• im.message.add, imbot.message.add — messages
• user.get, user.search — users
• placement.bind — registration of placement points

Batch: send up to 50 requests via batch. Batching is 50 times faster than sequential requests.

POST /rest/batch
{
  "halt": 0,
  "cmd": {
    "get_deal": "crm.deal.get?id=123",
    "get_contact": "crm.contact.get?id=456",
    "get_company": "crm.company.get?id=789"
  }
}

Webhook Handling Without Data Loss

Subscribe to events via event.bind. When an event occurs, Bitrix24 makes a POST to the handler URL. Important details:

• Handler must respond within 5 seconds.
• After 3 unsuccessful deliveries, the handler is unbound.
• For heavy processing, use a queue: accept the webhook, put it in a queue, respond 200, process asynchronously.

Available events: ONCRMLEADADD, ONCRMDEALUPDATE, ONTASKUPDATE, ONIMMESSAGECHAT, ONUSERADD, and hundreds more.

Example: In a multi-tenant CRM app, we reduced sync time from 30 seconds to 3 seconds by implementing event-driven Bitrix24 webhooks with an async queue — a 90% improvement.

Placements

Registration of placement is done during installation via placement.bind. It attaches to an interface point and passes context: entity ID, type, user permissions.

BX24.placement.getInterface(function(data) {
    console.log(data);
});

Connect //api.bitrix24.com/api/v1/ and call BX24.init() before accessing the API. In an iframe, use localStorage or postMessage.

Dealing with Tariff Limitations

REST methods are not available on all tariffs. crm.* — from certain plans, telephony.* — with telephony feature, tasks.* — with the 'Tasks' module. Upon installation, check availability via app.info and profile. Explicitly inform the user if functionality is unavailable. Do not allow unhandled 403s.

Application Data Storage

Bitrix24 provides a key-value store app.option.set/get (limit ~32KB). For serious data, you need your own DB. For user settings, use user.option.set/get on the portal side.

Development Timeline

What's Included

• Requirements analysis and architecture design
• CI/CD setup and deployment on your server
• REST API documentation and integration description
• Training for portal administrators
• One month of support after release

Infrastructure

The application must be accessible via HTTPS with a valid certificate. For production: dedicated domain, horizontal scaling (tokens in Redis/DB), monitoring of webhook handlers. Log all REST API calls, incoming webhooks, and OAuth exchanges. Proper architecture can save up to 40% on support time.

For more on OAuth, see Wikipedia: OAuth.

Our Bitrix24 integration services cover all types of custom Bitrix24 applications. Whether you need Bitrix24 app development, Bitrix24 marketplace application deployment, or Bitrix24 OAuth setup, we have the expertise. We've built numerous Bitrix24 widgets and Bitrix24 embedded applications that handle millions of records daily. Contact us for a consultation on your project. Get a preliminary timeline and cost estimate.

Marketplace Development on 1C-Bitrix: Overcoming Standard Architecture Limitations

The b_sale_order table and related b_sale_basket are not designed for multivendor out of the box. Bitrix has no built-in 'marketplace' module — each time it's custom development on top of the sale module. The standard sale module cannot split orders by different suppliers: if the cart contains items from three sellers, Bitrix creates a single order with one number, status, and total. It's impossible to send each sub-order to a separate dashboard, calculate commissions for each seller, or allow partial shipment. We have to redefine the entire logic: from cart to status model. Additionally, the standard search (Sphinx) and caching are not optimized for a multivendor catalog — with 100,000 items from 500 suppliers, filters by supplier lead to performance degradation (queries with WHERE on IBLOCK_ELEMENT_PROPERTY become 5–10 times slower). We write a separate module that extends the standard cart: adds item-to-supplier binding via order property, splits a single order into sub-orders by seller, and routes each separately.

Why Standard Solutions Are Not Suitable for Multivendor Platforms?

Marketplace Models

Classic marketplace — the operator does not hold inventory. All product logic lies with sellers, the platform handles traffic and payment gateway. Technically, this is a separate supplier infoblock linked via UF_VENDOR_ID in the highload catalog infoblock.

Hybrid model — the operator sells alongside external suppliers. The main pain: ranking in the catalog. If suppliers see that the platform's own listings always rank higher, they leave. We solve this with a separate sorting component where position is determined by rating, shipping speed, and price, without privileges for 'own' items.

Service marketplace — requests, tenders, escrow. Here, instead of b_sale_basket, a custom request entity works with a workflow via Bitrix business processes.

B2B marketplace — contracts, reconciliation statements, credit lines, EDI. Authorization by TIN, multi-price groups via b_catalog_group, shipping limits.

What Technical Problems Does Marketplace Development on 1C-Bitrix Solve?

Monetization Models

What Does the Seller Dashboard Include?

The dashboard is the heart of a marketplace. An inconvenient dashboard = empty platform. No standard solution exists; we build from scratch using Bitrix components.

• Catalog management — CRUD for products via custom component, bulk CSV/XML upload via CIBlockXMLFile. Nobody manually enters 10,000 SKUs, so import is the first thing we do.
• Order processing — sub-orders land in the dashboard via ajax-polling or websocket. Confirmation, invoice printing via CSalePdf, status update with back-sync to the main order.
• Financial analytics — dashboard on highload infoblock of aggregated data. Revenue, commissions, payouts — details by product and period. The seller sees what sells and what just occupies the showcase.
• Delivery settings — seller's own tariffs, binding to sale.delivery.handler.
• Communication — built-in chat without revealing contacts. Implemented via im module or custom message table.
• Promotions — discounts, promo codes via b_sale_discount with filter by vendor_id.

Moderation and Quality Control

One batch of counterfeit goods kills the platform's reputation. Therefore, moderation is mandatory.

• Product moderation — status ACTIVE='N' until verification. Auto-moderation filters obvious violations (banned words, missing photos), manual moderation handles disputes. Handler OnBeforeIBlockElementUpdate prevents bypass.
• Seller verification — TIN check via Federal Tax Service API, document scans upload. Statuses: new → verified → premium. Each level unlocks limits on product count and commissions.
• Rating system — not just stars. The algorithm considers shipping speed (AVG(ship_date - order_date)), return rate, and answer quality.
• Anti-fraud — detect rating manipulation by patterns (same IP, identical texts, abnormal frequency). Duplicate accounts caught by TIN and bank details.
• Typical mistake: storing supplier data in a regular infoblock — with 1000+ sellers, queries become slow. Use highload infoblocks.

How Is the Seller Payout System Structured?

The financial module is why sellers join the platform.

• Commission calculation — handler on order status change. Commission depends on category, seller status, current conditions. Stored in a separate table vendor_transactions.
• Periodic payouts — cron task generates a register: weekly, bi-monthly, or monthly. Minimum payout amount, holding until confirmation.
• Acts and reports — PDF generation via PhpOffice\PhpSpreadsheet, automatic numbering, one-click download.
• Holding — funds held until product received. Reduces disputes and returns.
• Payouts via banking API — YooKassa, CloudPayments, direct banking APIs. Seller receives money without calls or reminders.
• Important: splitting orders at the OnSaleOrderSaved handler leads to status mismatch. Split at the cart stage.
• Manual fiscalization of each sub-order violates 54-FZ. Use a single receipt with 'agent' attribute. On one project, fiscalization automation saved significant monthly costs. On another, search optimization via Elasticsearch reduced catalog loading time by 80% (from 3 seconds to 0.6 seconds).

How We Build Marketplace Architecture

1. Define business model — choose marketplace type and monetization scheme.
2. Database design — highload infoblocks for catalogs over 50,000 SKU, separate tables for sub-orders (orders_split) and transactions.
3. Core development — create module marketplace.vendor, implement product-to-supplier binding, order splitting mechanism, agents for commission calculation.
4. Payment gateway and 54-FZ integration — configure fiscalization via ATOL Online or CloudPayments.
5. Load testing — use k6 or ab to verify 5000 orders per day.

Typical Mistakes in Bitrix Marketplace Development

• Storing suppliers in a regular infoblock — causes slowdowns with >1000 records. Use highload infoblocks.
• Splitting orders after saving — breaks the status model. Split at the cart stage.
• Manual fiscalization of each sub-order — violates 54-FZ. Fiscalize with a single receipt with agent attribute.
• Ignoring tagged caching for the catalog — with multivendor, cache is invalidated entirely. Configure tags by vendor_id.

Technology Stack

• 1C-Bitrix 'Business' or 'Enterprise' — sale + catalog modules as foundation. Multivendor wrapper — custom modules.
• Highload infoblocks — catalogs over 100,000 SKU. Regular infoblocks at such volumes fail on filtering: CIBlockElement::GetList with a dozen properties generates JOINs on dozens of b_iblock_element_prop_sNN tables. Highload solves this with a flat structure.
• Elasticsearch — full-text search. Elasticsearch processes queries 10 times faster than the built-in search module (Sphinx). User types 'nike sneakers' — finds 'Nike sneakers'.
• Queues — catalog import, payout calculation, report generation. Bitrix agents (CAgent) for light tasks, separate queue via RabbitMQ or supervisor + custom CLI for heavy tasks.

We guarantee that the developed module will handle a load of up to 5000 orders per day on a standard VPS. Certified 1C-Bitrix specialists (over 10 years of experience, 50+ completed projects) perform architecture audit before development starts. At a scale of 2000 sellers, average moderation time is 15 minutes, and 95% of orders are processed automatically.

Industry Marketplaces

Each niche has its own pitfalls:

• Building materials — oversized delivery calculation. Pallets, tonnage, floor lift. Standard delivery calculator cannot handle it; we write custom sale.delivery.handler.
• Food products — expiration dates in infoblock properties, temperature regime, same-day delivery slots. A logistics error means write-off.
• Auto parts — VIN selection via Laximo API, cross-references, originals and analogs. A separate headache is different delivery times from different sellers for the same part.
• Clothing — size charts (EU/US/RU), high return rate. Return processing logic with commission redistribution is a whole layer.
• Industrial equipment — B2B with tenders, quotation requests. Product card with 50+ parameters in table form.

Timelines and Stages

Trying to launch everything at once is a sure way to launch nothing.

MVP in 3-4 months. Full-featured platform — 6-12 months of iterative development.

What Is Included

• Documentation: architecture diagram, API description, seller instructions.
• Access: code repository, test environment, admin panel.
• Training: two sessions for administrators and managers.
• Support: 1 month free support after launch, then according to SLA.
• Warranty on developed modules — 12 months.

Contact us for an assessment of your project — we will calculate timelines and cost individually. Request a consultation, and we will show on a real case how we solve the multivendor problem in 30 minutes. Get a detailed development plan for your marketplace today.