Magento API Getting Started: Account, Keys, First Request (2026)

This guide focuses on the practical steps for initiating development with the Magento API, covering account setup, credential generation, and executing a foundational API call. It assumes a basic familiarity with what Magento (Adobe Commerce) is and its role as an ecommerce platform.

Getting started overview

To begin interacting with the Magento API, you need an active Adobe Commerce instance and the necessary administrative permissions to create API users or integrations. The Magento API primarily uses RESTful web services, handling data in JSON format. Authentication typically involves token-based access, either through OAuth 1.0a for third-party integrations or direct token generation for administrative users. The process involves configuring API access within your Adobe Commerce administration panel, obtaining credentials, and then using these credentials to authorize your API requests.

Here’s a quick reference table outlining the essential steps to get started:

Create an account and get keys

Access to the Magento API is tied to an active Adobe Commerce license. There is no separate API-only account registration; your API access is configured within your existing Adobe Commerce instance. This section details how to set up an API integration, which is the recommended method for external applications to interact with your Magento store securely. For internal scripts or direct administrative access, you might generate an access token for an existing admin user, but integrations offer better security and granular control over permissions.

Setting up an API Integration

1. Log in to the Adobe Commerce Admin Panel: Use your administrator credentials to access your store's backend. The URL typically follows the format yourstore.com/admin.

2. Navigate to Integrations: In the Admin Panel, go to System > Integrations. You can find detailed instructions on setting up new integrations in the Magento API authentication documentation.

3. Add New Integration: Click the Add New Integration button.

4. Configure Integration Settings:

   • Name: Provide a descriptive name for your integration (e.g., "My Custom App").
   • Email: Enter an email address for notification purposes.
   • Callback URL: If your application uses OAuth 1.0a for authentication, provide the URL where Magento should redirect after authorization. If not using OAuth, this can be left blank or set to a placeholder.
   • Identity Link URL: Similar to the Callback URL, this is for OAuth-based identity linking.

5. API Resources: This is a critical step for security and functionality. Under the API tab, select the specific resources your integration needs to access. For example, if your application only manages products, grant access only to Catalog resources. Granting "All" permissions is generally discouraged for third-party integrations due to security implications. The Magento API quick reference provides a list of available resources.

6. Save and Activate: Click Save. After saving, you will be redirected to the Integrations grid. Find your new integration and click Activate in the Actions column. This step is crucial as it generates your API credentials.

7. Obtain Credentials: Upon activation, a dialog box will display your API credentials: Consumer Key, Consumer Secret, Access Token, and Access Token Secret. These are your API keys. Copy and store these securely immediately, as they will not be displayed again for security reasons. The Access Token is the most commonly used credential for direct token-based authentication.

Your first request

With your API credentials in hand, you can now make your first authenticated request to the Magento API. We will use a simple request to fetch a list of products from your store. This example uses cURL, a command-line tool for transferring data with URLs, which is widely available on most operating systems and a common method for testing REST APIs. For production applications, you would typically use an HTTP client library in your chosen programming language.

Prerequisites:

• A working Adobe Commerce instance with the API integration configured.
• The Access Token obtained in the previous step.
• The URL of your Magento API endpoint, typically https://yourstore.com/rest/V1/.
• cURL installed on your system.

Making the Request (Fetch Products)

Replace YOUR_MAGENTO_URL with your actual store's base URL (e.g., magento.example.com) and YOUR_ACCESS_TOKEN with the Access Token you generated.

curl -X GET \
  "https://YOUR_MAGENTO_URL/rest/V1/products" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"

Explanation of the cURL command:

• -X GET: Specifies the HTTP method as GET, used for retrieving data.
• "https://YOUR_MAGENTO_URL/rest/V1/products": This is the API endpoint to retrieve products. The V1 denotes the API version.
• -H "Authorization: Bearer YOUR_ACCESS_TOKEN": This header provides your authentication token. Magento API uses a Bearer token scheme for access tokens.
• -H "Content-Type: application/json": Although not strictly necessary for a GET request, it's good practice to specify that you expect JSON data.

Expected Response

If successful, the API will return a JSON array of product objects available in your store. The structure will vary based on your products and Magento configuration, but it will generally look like this (abbreviated for brevity):

{
  "items": [
    {
      "id": 1,
      "sku": "MS-P-1001",
      "name": "Yoga Mat",
      "attribute_set_id": 9,
      "price": 34.00,
      "status": 1,
      "visibility": 4,
      "type_id": "simple",
      "created_at": "2023-01-01 10:00:00",
      "updated_at": "2023-01-05 15:30:00",
      "extension_attributes": {},
      "product_links": [],
      "options": [],
      "media_gallery_entries": [],
      "tier_prices": [],
      "custom_attributes": []
    },
    {
      "id": 2,
      "sku": "MS-B-2002",
      "name": "Water Bottle",
      "attribute_set_id": 9,
      "price": 12.50,
      "status": 1,
      "visibility": 4,
      "type_id": "simple",
      "created_at": "2023-01-02 11:00:00",
      "updated_at": "2023-01-06 09:45:00",
      "extension_attributes": {},
      "product_links": [],
      "options": [],
      "media_gallery_entries": [],
      "tier_prices": [],
      "custom_attributes": []
    }
  ],
  "search_criteria": {
    "filter_groups": []
  },
  "total_count": 2
}

A successful response with a 200 OK HTTP status code and product data indicates that your API integration and authentication are working correctly.

Common next steps

After successfully making your first API call, consider these next steps to deepen your integration with Magento API:

1. Explore More API Endpoints: The Magento API reference lists numerous endpoints for managing customers, orders, categories, shipments, and more. Experiment with different GET, POST, PUT, and DELETE requests to understand the API's full capabilities.

2. Implement OAuth 1.0a (for 3rd-party apps): If you are building a public or third-party application, implementing the full OAuth 1.0a flow is essential for secure user authorization without storing user credentials. The OAuth 1.0a specification provides details on this authentication mechanism.

3. Error Handling: Implement robust error handling in your application. The Magento API returns specific HTTP status codes and error messages in JSON format to help you diagnose issues, such as 401 Unauthorized for invalid tokens or 404 Not Found for non-existent resources.

4. Pagination and Filtering: For large datasets, learn how to use pagination (searchCriteria[currentPage], searchCriteria[pageSize]) and filtering (searchCriteria[filterGroups]) to retrieve specific data efficiently. This is crucial for performance optimization.

5. Webhooks: Investigate Magento's webhook capabilities to receive real-time notifications about events in your store (e.g., new order, product update). This allows for event-driven integrations rather than constant polling.

6. Development Environment Setup: For more complex integrations, consider setting up a local Magento development environment or a staging instance to test your API calls without affecting your live store.

Troubleshooting the first call

Encountering issues during your first API call is common. Here's how to troubleshoot some typical problems:

• 401 Unauthorized:

  • Invalid Token: Double-check that the Access Token in your Authorization: Bearer header is correct and hasn't expired. Regenerate it if necessary.
  • Incorrect Scope/Permissions: Ensure your integration has been granted access to the specific API resources you are trying to access (e.g., Catalog for products). Review and update permissions in the Admin Panel under System > Integrations > [Your Integration] > API.
  • Token Type: Confirm you are using a Bearer token. Other Magento authentication methods (like OAuth 1.0a) require different header formats.

• 404 Not Found:

  • Incorrect URL: Verify the base URL of your Magento store and the API endpoint path. Ensure /rest/V1/ is correctly included.
  • API Endpoint Spelling: Check for typos in the endpoint (e.g., products vs. product). Refer to the Magento API quick reference for exact paths.
  • Store Code in URL: If your Magento instance uses multiple store views, you might need to include the store code in the URL, e.g., /rest/V1/en_us/products.

• 500 Internal Server Error:

  • Server-side Issue: This typically indicates a problem on the Magento server itself. Check your Magento server logs (var/log/ directory) for more specific error messages.
  • Invalid Request Body: If you are making a POST or PUT request, ensure your JSON request body is valid and adheres to the expected schema for the endpoint.
  • PHP Memory/Execution Limits: For complex operations, the server might hit PHP memory limits or execution time limits. Consult your server administrator.

• No Response / Connection Timed Out:

  • Firewall/Network Issues: Ensure your development environment can reach your Magento server over the network. Check any firewalls or network configurations.
  • Incorrect HTTPS/HTTP: Confirm you are using the correct protocol (HTTPS is generally recommended and often required).

Always review the Magento API documentation for specific endpoint requirements and error codes. Using a tool like Postman or Insomnia can also help debug API requests by providing a user-friendly interface to construct and send requests, and inspect responses.