Your products can be set up through the "Game Shop" section on your games edit pages. The Game Shop API works independently from the rest of the API. There's only one URL per a product and it is there for you to be able to check if a user owns the product or not.
This is used to then unlock or perform the action from within your game if you recieve a true response from calling the "Product Check URL" with Ajax, XMLHTTP etc. If your not sure what this means then go back and read the getting started section. It may not all be relevent but it will ease you in to how the API works.
All payments are made direct to your paypal account. Add your paypal email address to the settings (within the header of the main site, once logged in) for your account. If you try to test your game externally then the response will always be false, use the tester below or test by uploading your game to see it working.
You don't need to do anything else extra to open the shop menu in your game. By default, once you have added a product to your game, the open shop button will appear as a seperate layer above your game within the game window.
Although if you would also like the shop menu to open at a certain point from your game (within the main menu etc). Then you can use the below JS code (Thanks to vkrishna for the below snippet):
As explained in the getting started section of this documentation. HTML5 games are all client side, that means all the coding is accessible to the user. Which does mean that users, who know what they are doing and willing to persist, are able to access the areas of your game you don't want them to have unless they have paid. Although that being said, desktop games are illegally shared which anyone can do. At least with a HTML5 game you can try to make it harder and upload a new version if needed.
Also all the payment processor and shop part of the system are all part of the platform and all done server side to make it secure.