First steps of creating API integration with Magento2.3

Question

background: I'm new to Magento as I haven't used it before, but I've read through most of the API documentation now. I have an online dashboard application with various widgets that are different API integrations. We mostly read data from APIs to display to our users in a way that they find useful such as various charts. Many of our users have been requesting a new Magento widget.

question(s): I see the API has many different uses after reading through documentation and other posts in forums, but I'm still confused on a couple things. I see to develop and test an API integration we will need to download Magento with sample data. I have done this but haven't got the web server setup because I had a couple questions come to mind and I didn't want to waste time on something that wouldn't work as I had expected. Will the API allow each one our users to authenticate to their own Magento data? I want to make sure the API isn't just for developing within a users own company. Our company isn't interested in currently using Magento, but our users want to give us access to their data via API so we can read the data and end up displaying the data in charts so they can easily see trends and stuff like that. If the API doesn't support that just let me know and you don't need to answer my next question!

https://devdocs.magento.com/guides/v2.3/get-started/authentication/gs-authentication-oauth.html Here I see that the authentication flow is different that how most of our integrations work. Normally our users add a new widget to their dashboard and then configure the widget. If the integration uses oauth the user will click "Add Account" which sends a request to API endpoint and then user will sign into integration account via Oauth and data needed to make requests are returned. With your API it seems the authentication starts on your end after a user creates an integration within admin panel and then that's sent to given URLs. How would I know which of our users this information belongs to? Even if this isn't how we normally setup widgets I think we could find a way to make this work, but it seems that there's nothing unique being sent in the request to let us know which user this consumer key and secret would belong to. That is what brought up my first question I mentioned earlier.

Please let me know if you need any more information or clarification for what I said. Thank you for your time!

Answer 1

I will be trying to make an answer quite simple for you to see through Magento a bit more fluently. (background, there is a lot of documentation and a couple of sentences may guide you to understand what is what..)

Magento is an e-commerce framework (php code and connect to mysql).

In steps:

1. you may deploy this framework with simple data (in this process, you do have to setup a webserver indeed)
2. you have at this point an ecommerce website that you can use: purchase items and create customer and so on (I understand this is not something you are interested but just to make it clear, this is what most people use Magento for). Also, anybody using this site will be able to create orders, register as a new customer like we do onto a site. By doing this the sample data are modified and your API queries can have different returned data
3. finally, with just setting up the API (add an API user in the backend for querying some Magento API with a token), you have now access to all the Magento API to gather the data that the website host in its mysql database

--> you can create as many API users as you want and each can have different privileges (access different API)

--> the data that you will receive from these API calls will be the data in your mysql database and therefore will be the data related to the sample data (2k products, 1 customer and 2 orders are the content pretty much of the sample data)

I hope this clarify your situation. I don't see what you call "your users' own Magento data" and therefore I hope you see now that the data in the Magento API are only reflecting the e-commerce data you have in your site.

Answer 2

Let's go with API first - In general, the purpose of a repository is to hide the storage related logic.

Why and Where to use it.

• A client of a repository should not care whether the returned entity is held in memory in an array, is retrieved from a MySQL database, fetched from a remote API or from a file.
• If a third party module use only the repositories, Magento can change how and where data is stored, and the module will continue to work, despite these deep changes.
• Repositories generally have methods like findById(), findByName(), put() or remove().
• In Magento these commonly are called getbyId(), save() and delete(), not even pretending they are doing anything else but wrap CRUD DB operations.

Magento 2 repository methods can easily be exposed as API resources, making them valuable for integrations with third party systems or headless Magento instances.

---

• With service contracts usage (Api/Data interfaces), it will be possible to expose custom module functionality as web API just by adding config etc/webapi.xml
• Improved capabilities for integration with 3rd party systems based on service contracts will be added in the future, as well as queue support.
• If there is another module dependent on your module, it can just rely on service interfaces. This reduces coupling between modules and minimizes risk of accidental breaking of dependent module.

Now when should I create Api/Data interfaces, repository interfaces in this case if it is needed?

• Service contracts enhance the modularity of Magento. They enable Magento and third-party developers to report system dependencies through composer.json files and, consequently, guarantee compatibility among Magento versions. This compatibility ensures that merchants can easily upgrade Magento.
• Data entities are a side benefit of service contracts. The database tables that normally support these entities can be complicated. For example, some attributes might be stored in an EAV table, so a set of MySQL database tables might define a single data entity . Data entities in a service contract reveal a simpler data model than the data model in an underlying relational database schema . Eventually, you will be able to use different storage technologies for different data collections. For example, you could use a NoSQL database to replace product tables.
• Using the @api tag - Backward compatibility can be indicated by the use of @api. For more information, see Backward compatibility.

Magento 2 Api/Data, When To Create It?

As always, the answer is “It depends”. (In Vinai Kopp's words)

1. If your entities will be used by other modules, then yes, you probably want to add a repository.
2. There is another factor that should be added into the equation: in Magento 2, repositories can easily be exposed as Web API - that is REST and SOAP - resources.
3. If that is interesting to you because of third party system integrations or a headless Magento setup, then again, yes, you probably want to add a repository for your entity.

For more Information

1. https://devdocs.magento.com/guides/v2.0/extension-dev-guide/service-contracts/service-contracts.html
2. https://devdocs.magento.com/guides/v2.0/extension-dev-guide/service-contracts/service-to-web-service.html
3. http://vinaikopp.com/2017/02/18/magento2_repositories_interfaces_and_webapi/

Not let's go for HOW ?

Open the System > Extensions > Integrations

Add New Integration

Set the integration Name and other settings, then specify your Magento 2 back-end password in the Your Password field

Switch to the API sidebar tab and select the resources which will be available to OAuth clients:

Press the Save button. The integration will be saved and the Integrations list will be shown again. Press the Activate link in the integration row:

A confirmation screen will be shown. Press the Allow button

The credentials screen will be shown. Use them in your third-party software to access your Magento 2 as OAuth server.

You will see:

• Consumer Key
• Consumer Secret
• Access Token
• Access Token Secret

Copy it to somewhere, then press the Done button.

The integration will be saved and the Integrations list will be shown again. You will see your integration in the Active state:

Answer 3

Will the API allow each one our users to authenticate to their own Magento data?

If I understand your question correctly.

1. Your customer (user) has a magento 2 website.
2. You need your user to grant access to their data so you can display on your Dashboard (Your Application)

The answer is a big YES,

Many companies are doing that way like:

1. https://marketplace.magento.com/zonos-checkout.html
2. https://www.taxjar.com/guides/integrations/magento2/

You can build your own magento 2 integration extension and publish it to magento marketplace for driving users to your dashboard.

If you need more detail of about developing a magento 2 integration extension, you can refer a blog I made pretty detail here:

Create an Integration in Magento 2 for Your APPLICATION

I really hope it helped.