Shopee Getting Started: Account, Keys, and First API Call (2026)

Getting started overview

Integrating with the Shopee Open Platform allows sellers to automate various e-commerce operations, including product listing, order management, and logistics. This guide provides a structured approach to initiate your integration, focusing on account setup, credential acquisition, and making an initial API request.

The Shopee Open Platform is designed for developers to build applications that enhance seller efficiency within the Shopee ecosystem. It provides programmatic access to critical functionalities, enabling custom solutions for inventory synchronization, order fulfillment, and customer service. The platform primarily uses RESTful APIs with JSON payloads for data exchange and HMAC-SHA256 for request signing to ensure security and authenticity of communications. For a comprehensive list of available APIs and their specifications, refer to the Shopee API reference documentation.

Before making any API calls, you will need to register as a developer, create a partner account, and link your seller shop. This process ensures that your application has the necessary permissions to interact with your specific shop's data. Understanding the authentication mechanism, which involves a Partner ID, Shop ID, and API keys, is crucial for successful integration.

Here's a quick reference table outlining the essential steps to get started:

Create an account and get keys

To begin, navigate to the Shopee Open Platform documentation. You will need to register as a developer to access the necessary tools and documentation. This initial registration typically involves providing basic contact information and agreeing to the platform's terms of service.

1. Register a Developer Account: Go to the Shopee Open Platform website and sign up. This creates your developer identity.
2. Create a Partner Account: After registration, you will be directed to the Partner Center. Here, you create a Partner Account, which is distinct from your regular seller account. This account is where your applications will be managed. Upon creation, you will receive a unique Partner ID.
3. Create a New Application: Within your Partner Account, create a new application. You will need to provide an application name and a callback URL. The callback URL is used for the OAuth authorization flow, where sellers grant your application permission to access their shop data. After creating the application, you will be assigned an App ID and an App Key (also known as Secret Key). The App Key is critical for signing requests and should be kept confidential.
4. Authorize Your Shop: For your application to interact with a specific Shopee shop, that shop must authorize your application. This is typically done through an OAuth 2.0 authorization flow. As a developer testing your own integration, you will authorize your own seller account. The process involves constructing an authorization URL using your Partner ID, App ID, and the redirect URL. The seller (you) clicks this link, logs into their Shopee seller account, and grants permission. Upon successful authorization, Shopee redirects back to your specified callback URL with a code and shop_id. The shop_id is essential for all subsequent API calls related to that specific shop. You then exchange the code for a temporary access_token and refresh_token. The access_token is used to authenticate API requests, while the refresh_token allows you to obtain new access tokens when the current one expires, preventing the need for repeated manual authorization.

It is important to store your App Key and refresh_token securely, as they grant access to your Shopee shop's data. Best practices for secure credential management, such as using environment variables or secret management services, should be followed, as outlined in general API security guidelines like those provided by Google Cloud API key best practices.

Your first request

Once you have obtained your Partner ID, Shop ID, App ID, App Key, and an access_token, you are ready to make your first authenticated API request. Shopee's API uses HMAC-SHA256 for request signing to ensure data integrity and sender authenticity. Every request must be signed.

Here's a general outline of the steps to construct and sign an API request:

1. Choose an API Endpoint: For a simple test, consider an endpoint that retrieves shop information, such as /api/v2/shop/get_shop_info. You can find details for this and other endpoints in the Shopee API documentation.
2. Prepare Request Parameters: All requests require common parameters: partner_id, shop_id, timestamp (current Unix timestamp in seconds), and access_token. Specific API calls may require additional business parameters.
3. Construct the Base String for Signing: The base string for signing typically concatenates the App Key, the request path (e.g., /api/v2/shop/get_shop_info), and all request parameters (including common and business parameters, sorted alphabetically). The exact format for the base string is crucial and detailed in the Shopee API authorization guide. For example, it might look like AppKey + path + partner_id + shop_id + timestamp + access_token.
4. Generate the Signature: Use the HMAC-SHA256 algorithm to hash the base string, using your App Key as the secret key. The resulting hash is your signature.
5. Include Signature in Request Header: The generated signature is typically sent in the Authorization header or as a query parameter, depending on the specific API version and endpoint. For Shopee's v2 API, the signature is usually appended as a query parameter named sign.
6. Make the HTTP Request: Send the request to the appropriate Shopee API endpoint (e.g., https://partner.shopeemobile.com/api/v2/shop/get_shop_info for the live environment).

# Example (conceptual, Python-like pseudocode)
import hmac
import hashlib
import time
import requests

PARTNER_ID = 123456
APP_ID = 789012
APP_KEY = "your_app_key_secret"
SHOP_ID = 987654321
ACCESS_TOKEN = "your_access_token"

# 1. Choose API endpoint
path = "/api/v2/shop/get_shop_info"
base_url = "https://partner.shopeemobile.com"

# 2. Prepare request parameters
timestamp = int(time.time())

# Parameters for signing (must be sorted alphabetically)
params_for_signing = {
    "partner_id": PARTNER_ID,
    "shop_id": SHOP_ID,
    "timestamp": timestamp,
    "access_token": ACCESS_TOKEN
}

# Construct the base string for signing
# The exact construction might vary slightly based on Shopee's latest docs
# Typically: AppKey + path + sorted_concatenated_params

# Example of parameter concatenation (actual Shopee format might differ slightly)
# Refer to Shopee's official API authorization documentation for the precise string format.
param_string = "".join([f"{k}{v}" for k, v in sorted(params_for_signing.items())])
base_string = f"{APP_KEY}{path}{param_string}"

# 3. Generate the signature
sign = hmac.new(APP_KEY.encode('utf-8'), base_string.encode('utf-8'), hashlib.sha256).hexdigest()

# 4. Include signature and other parameters in the final request URL
query_params = {
    "partner_id": PARTNER_ID,
    "shop_id": SHOP_ID,
    "timestamp": timestamp,
    "access_token": ACCESS_TOKEN,
    "sign": sign
}

request_url = f"{base_url}{path}?{requests.compat.urlencode(query_params)}"

# 5. Make the HTTP Request
response = requests.get(request_url)

if response.status_code == 200:
    print("Success:", response.json())
else:
    print("Error:", response.status_code, response.text)

This pseudocode demonstrates the general flow. Always consult the Shopee API authorization guide for the most current and precise method of constructing the signature string and request URL, as these details are critical for successful authentication.

Common next steps

After successfully making your first API call, you can explore more advanced integrations with the Shopee Open Platform. The following are common next steps for developers:

• Explore Product Management APIs: Implement functionality to list new products, update existing product information (e.g., price, stock), and manage product categories. The Shopee Product API reference provides details on these operations.
• Integrate Order Management: Develop systems to retrieve new orders, update order statuses, and manage shipping details. This is crucial for automating fulfillment processes.
• Implement Logistics and Shipping: Integrate with Shopee's logistics services to generate shipping labels, track parcels, and manage returns.
• Webhooks for Real-time Updates: Configure webhooks to receive real-time notifications for events like new orders, order status changes, or product updates. This reduces the need for constant polling and improves responsiveness. Information on setting up webhooks can typically be found in the Shopee developer documentation under notification services.
• Error Handling and Logging: Implement robust error handling mechanisms and comprehensive logging for your API interactions to diagnose issues quickly and efficiently.
• Scalability Considerations: As your application grows, consider strategies for managing API rate limits and optimizing request patterns to ensure smooth operation, especially during peak sales periods.

Troubleshooting the first call

Encountering issues during your first API call is common. Here are some typical problems and their solutions:

• Invalid Signature: This is the most frequent issue. Double-check the following:
  • Ensure the App Key used for signing matches the one provided in your developer console.
  • Verify the exact order and format of parameters concatenated to form the base string for signing. Any deviation, including extra spaces or incorrect casing, will result in an invalid signature. Refer strictly to the Shopee API authorization documentation.
  • Confirm the timestamp is a current Unix timestamp in seconds and is consistent between the signed string and the request parameters.
  • Ensure the access_token, partner_id, and shop_id are correct and included in both the signing string and the request.
• Unauthorized Access (HTTP 401):
  • Your access_token might be expired. Use your refresh_token to obtain a new one.
  • The Shop ID might be incorrect or not authorized for your application. Verify the shop authorization status in the developer console.
  • Ensure the correct partner_id and app_id are used.
• Bad Request (HTTP 400):
  • Missing or malformed required parameters in your request body or query string. Check the specific API endpoint's documentation for required parameters and their data types.
  • Incorrect JSON format in the request body for POST/PUT requests. Use a JSON validator to confirm syntax.
• Rate Limit Exceeded (HTTP 429):
  • You are sending too many requests in a short period. Implement exponential backoff or other rate-limiting strategies in your application. For Shopee's rate limits, consult the Shopee developer documentation on API limits.
• Incorrect Endpoint or HTTP Method:
  • Verify that you are using the correct base URL (e.g., https://partner.shopeemobile.com for the live environment).
  • Ensure you are using the correct HTTP method (GET, POST, PUT, DELETE) for the specific API endpoint.

When debugging, always refer to the specific error codes and messages returned by the Shopee API, as they often provide direct clues to the problem. Utilize logging in your application to capture request details, including the constructed URL, headers, body, and the exact string used for signing, to aid in pinpointing discrepancies.