Using the rest-API, authentication fails

[Chrisabo]

Hi,

I’m trying to use the rest-API with Postman to test the possibilities. I have an API-key and the API-Secret key. I’m using BASIC authentication where the username is het API_key and the Password is the API_secret.

I have a postman collection specific for Shopify. I expected this would be a no brainer to start with this.

If I send the following https://{{store_name}}.myshopify.com/admin/api/{{api_version}}/products.json with the Basic Authentication, the result is:

“errors”: “[API] Invalid API key or access token (unrecognized login or wrong password)”

I have acces to two shops and the problem is the same for both. I suppose there is something in the shop that must be activated in the admin?

Anyone who has suggestions about the possible cause of this problem?

Best regards,
Chris Andries

[snakecase]

Shopify is using oauth as authentication system. Your API key and and API secret must not used the way you try to use them.

To get an overview on authentication, you can have a look at Shopify documentation: Authentication and authorization overview

If you want to bypass all of that the quickest way is to obtain an access token following the documentation Access tokens for custom apps in the Shopify admin

Once you have an access token you can set it to the X-Shopify-Access-Token header of your requests and from there it should work

curl -X GET \
https://{shop}.myshopify.com/admin/api/2023-04/products.json \
-H 'Content-Type: application/json' \
-H 'X-Shopify-Access-Token: {access_token}'

[JR00]

I had the same problem
In my case, I found an error in the url, which was the wrong name of the store.
I first took just the name of the store from the settings, later I took the name with the current active (custom domain) and it all did not work.
In the end I used the url with the domain “.myshopify.com” which was automatically generated by Shopify and it worked.

You also can find correct store name in url when you open admin tab (Home, Orders or Products it is doesn’t matter)

[Chrisabo]

Hi,
Thanks for your answer. With the use of an access token, now everything works. Thanks for pointing me into the right direction.