Shopify admin api allows GET requests, but not POST requests (get 200 status OK response, but no products are being created)

[rossH]

Hello all, 

I am trying to create a product through the api using a POST to <mywebsite>.myshopify.com/admin/products.json with basic authentication in the header (which I have read is a valid way of using the api). Using the postman chrome app I get a 200 OK status returned, using native node js code I get a 401 return code with error message "{"errors":"[API] Invalid API key or access token (unrecognized login or wrong password)"}".

The postman method of creating the product does not seem to actually create the product, I can't find the product on the website anywhere.

Here is the rquest body:

{
"product": {
    "title": "arb product CREATED THROUGH API",
    "body_html": "aaa",
    "vendor": "vendor brand",
    "product_type": "producttype category",
    "published": "true"
  }
}

Also some extra info that may be useful: The way I cma contactign the api is through private apps, the read /write permissions for products is set appropriately, whether I attempt to POST to <mywebsite>.myshopify.com/admin/products.json  or https://apikey:password@hostname/admin/products.json it makes no difference.

Any idea why this is?

[Jason]

Read through some other posts in the forum. Are you sure you're not sending cookies along with the post request? If you are, you'll run into issues. 

Since you're using JavaScript - which I have to question from a security standpoint - cookies are going to be sent along via the browser. Shopify will block that request.

If you're unable to remove cookies from Postman (for example) consider using the X-Shopify-Access-Token instead. More info on that on the Getting Started: Authentication docs.

https://help.shopify.com/api/getting-started/authentication

The data you've provided lets me create a product via the API without issue so I suspect there's some issue with how you're sending the data.

[rossH]

Does this mean I need to set up and use oauth to use the API?

[rossH]

Actually I have just modfied the headers - I dropped the Basic Authentication header and am now just using the Content-Type header and the X-Shopify-Access-Token header with my api password. It seems to work fine now.

Is this what you meant for me to do? Or am I still butchering the process haha?

[Jason]

Is this what you meant for me to do?

Exactly that. You've got it covered ;)

[Fabjon_Gjuzi]

I have the same problem and using X-Shopify-Access-Token is not working, still returns login page.

Suggestions please!

Thank you!

Edit: I am using private app

[rossH]

Currently what I am doing, mind you I am doing this in node js (I can't get post man to actually post product data because of an issue with cookies i think)

the url endpoint I am making the http POST request to is: https://<my_website>.myshopify.com/admin/products.json

with headers:

* Content-Type : application/json

* X-Shopify-Access-Token : <api_password>

Here is the full node js script (minus my credentials and url of course) that I use to hopefully fix you up : 

var https = require('https');

var product = {
  "title": "Burton Custom Freestyle 151",
  "body_html": "<strong>Good snowboard!<\/strong>",
  "vendor": "Burton",
  "product_type": "Snowboard",
  "published": false
}

var productJson = JSON.stringify({product: product});


var post_options = {
  "method": "POST",
  "host": "<my_website>.myshopify.com",
  "port": null,
  "path": "/admin/products.json",
  "headers": {
    "Content-Type": "application/json",
    "X-Shopify-Access-Token": "<api_password>"
  }
};

var post_request = https.request(post_options, function (res) {
  res.setEncoding('utf-8');
  console.log(res.statusCode);
  res.on('data', function (chunk) {
    console.log('Response: ' + chunk)
  });
});

post_request.write(productJson);
post_request.end();

[Fabjon_Gjuzi]

api_password is from Password field at Authentication section on private app or is Access Token from Custom Storefront?

thank you

[rossH]

api_password is from authentication section for your private app.

Hope that helps

[Fabjon_Gjuzi]

still does not work...................I have also removed basic auth from url :/