Reflektit workspace · Getting connected

Your workspace, connected.

Register a website, configure its SDK integration and receive signed webhook events.

01Create your workspace

Sign up or log in using an email address and a password of at least 12 characters. Each account manages its own websites and webhook settings. This first version has no email verification, recovery email or SSO; use it for evaluation while deployment review is pending.

02Register and verify a website

  1. Register the exact HTTPS origin, including its subdomain: for example https://shop.example.com.
  2. Copy the displayed DNS TXT record into your domain provider. The record for that example is at _mreyti.shop.example.com; some providers expect the relative label _mreyti.shop.
  3. Wait for propagation, then press Check verification.
  4. Paste the generated script snippet into that website. It loads the current hosted SDK after checking the registered origin.

The website ID is public configuration, not a secret or a licence enforcement mechanism. The camera remains off until the shopper presses Start. To set your own catalogue, listen for mreyti-mounted on the target before the deferred loader runs, then call event.detail.element.setFrames(yourFrames) and set its sku. See frame setup.

Removing a website prevents future managed configuration loads. It cannot erase an SDK somebody already copied or stop an already running widget.

03Receive signed events

Save your public HTTPS endpoint in website settings. Copy the signing secret immediately: it is shown only when saved or rotated. Store it on your receiving server. Once the website is verified, press Send test event and inspect the delivery status.

Supported events are website.verified (when an endpoint already exists) and webhook.test. Their payload contains only an event ID, type, timestamp, website ID and origin. No camera images, face landmarks, measurements or shopper usage events are sent.

Verify the exact raw request body before parsing JSON:

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyReflektitWebhook(rawBody, headers, secret) {
  const timestamp = headers['mreyti-timestamp']
  const signature = headers['mreyti-signature']
  if (typeof timestamp !== 'string' || !/^\d{10}$/.test(timestamp)) return false
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false
  if (typeof signature !== 'string' || !/^v1=[a-f0-9]{64}$/.test(signature)) return false
  const expected = createHmac('sha256', secret)
    .update(timestamp + '.').update(rawBody).digest()
  return timingSafeEqual(expected, Buffer.from(signature.slice(3), 'hex'))
}

Deduplicate the payload's event id durably. Return 2xx for accepted or already processed events. Reflektit attempts delivery up to five times, retrying after 60, 120, 240 and 480 seconds. It does not follow redirects and rejects private or special-purpose network destinations. Delivery history is kept for 30 days.

Disabling a webhook cancels queued deliveries; an in-flight request may finish. When rotating the secret, allow for in-flight events signed with the previous one.

04Explore avatar try-on

Open Avatar studio to generate a generic 3D character, change the sample frame, rotate the view and download a PNG. Generation runs locally and does not use a camera, uploaded photo or external image service. The character is not a personal likeness and cannot confirm physical fit.

Clothing try-on

In the dashboard, open Clothing try-on and choose your website. Import a product image, name, SKU, category and optional price/description. Select a product, upload a clear face-only portrait, read the Aigen notice and press Generate dressed avatar. AI creates a full-body avatar wearing the garment. Its body and pose are invented, facial likeness and garment details may vary, and the result does not confirm physical fit.

Verify your website and enable public shopper previews to obtain a shareable collection link for your store. Public previews default off. Aigen may retain uploaded references and generated images; Reflektit does not store personal photos/results. This flow uses uploaded files and is separate from the local webcam mirror.

The API needs server-only AIGEN_URL, AIGEN_KEY and optionally AIGEN_PROVIDER (vertex). Restart the development API after configuring its gitignored .env, or rebuild both Compose services for production. Do not put project keys in client code. Daily attempt limits apply: 10 per merchant, 5 per shopper IP, 20 per website and 50 across the server. Failed attempts count; generation is never retried automatically.

3D product models

Give a product a 3D model that shoppers can turn on your product page with a finger, the mouse or the arrow keys. Open Products, choose the product, open the 3D model tab and press Make 3D model. Reflektit builds it from the product's primary image with TRELLIS.2 on Runware. It takes about a minute, and you can leave the page while it runs. When it is ready the tab shows the model, its size and cost, and the code for your page.

Add it to your product page below the Reflektit script tag. What you put inside is shown until the model loads, and stays if the product has no model, so the same markup works on every product page:

<div data-mreyti-3d="YOUR-SKU" style="height:420px">
  <img src="your-product-photo.jpg" alt="Product name">
</div>

Press Copy code in the 3D model tab to get it with your SKU filled in. Your website must be registered for the model to show to shoppers.

  • Use a product-only photo. A photo of the product alone on a plain background works best. Anything else in the photo, a person included, is turned into 3D too.
  • A new image needs a new model. If you replace the product image, the model is marked out of date and hidden from shoppers until you make it again.
  • It is a view, not a fitting. The model is made from one photo and has no measured size. It is never placed on a face and says nothing about how the product fits. Details may differ from the real product.
  • Limits. One model at a time per website, 20 requests a day, 100 models per website. Deleting a product deletes its model.

Each attempt counts in Analytics & credit with your other AI usage. The product image is sent to Runware to build the model; no shopper data is involved.

05Run the account service

The dashboard requires the Node account API. For local development, first build the SDK, then start the API and Vite in separate terminals:

npm run build:lib
PUBLIC_ORIGIN=http://127.0.0.1:3002 npm run dev:api
npm run dev -- --host 127.0.0.1

Set PUBLIC_ORIGIN to the exact URL and port printed by Vite. The default proxy points to API port 3004. Local accounts and the encryption key are stored in the gitignored .data/ directory.

For deployment, use compose.yaml with a persistent database volume, an HTTPS public origin and a stable 64-character hex MREYTI_SECRET_KEY in the server's secret manager. Generate a key with openssl rand -hex 32. Keep it separate from the database backup and never expose it to browsers. Start the two-service stack with docker compose up --build -d.

The old static-only container does not provide login or SDK configuration routes. The operator must deploy the API alongside nginx. Run one API instance; this SQLite-backed version is not designed for horizontal scaling. The existing full-runtime size gate still blocks automated releases.

Analytics & credit

Open Analytics & credit to see your AI requests, clothing previews and 3D product models, by website and the last 7, 30 or 90 UTC calendar days. Review generated looks, failures, recorded charges, average generation time, daily charts, top products and recent results. Tracking begins with this update; earlier Aigen usage cannot be assigned to products. Unknown charges are disclosed rather than counted as free.

Configured billing operators also see the shared Aigen project's live credit, current image price and estimated images remaining: floor(balance divided by image price). These project totals include every app using the key. The balance is cached for 60 seconds and stale values are labeled. Actual Aigen charges already include markup. No separate merchant wallets are created.

To enable shared credit viewing, set server-only MREYTI_BILLING_VIEWER_IDS to the verified operator account's stable user ID from the deployed database (comma-separated for multiple accounts). The default grants nobody access; unverified email addresses cannot grant this permission. Each merchant can always view their own usage. Analytics stores request metadata, never shopper photos or biometric measurements.