background: I'm new to Magento as I haven't used it before, but I've read through most of the API documentation now. I have an online dashboard application with various widgets that are different API integrations. We mostly read data from APIs to display to our users in a way that they find useful such as various charts. Many of our users have been requesting a new Magento widget.

question(s): I see the API has many different uses after reading through documentation and other posts in forums, but I'm still confused on a couple things. I see to develop and test an API integration we will need to download Magento with sample data. I have done this but haven't got the web server setup because I had a couple questions come to mind and I didn't want to waste time on something that wouldn't work as I had expected. Will the API allow each one our users to authenticate to their own Magento data? I want to make sure the API isn't just for developing within a users own company. Our company isn't interested in currently using Magento, but our users want to give us access to their data via API so we can read the data and end up displaying the data in charts so they can easily see trends and stuff like that. If the API doesn't support that just let me know and you don't need to answer my next question!

https://devdocs.magento.com/guides/v2.3/get-started/authentication/gs-authentication-oauth.html Here I see that the authentication flow is different that how most of our integrations work. Normally our users add a new widget to their dashboard and then configure the widget. If the integration uses oauth the user will click "Add Account" which sends a request to API endpoint and then user will sign into integration account via Oauth and data needed to make requests are returned. With your API it seems the authentication starts on your end after a user creates an integration within admin panel and then that's sent to given URLs. How would I know which of our users this information belongs to? Even if this isn't how we normally setup widgets I think we could find a way to make this work, but it seems that there's nothing unique being sent in the request to let us know which user this consumer key and secret would belong to. That is what brought up my first question I mentioned earlier.

Please let me know if you need any more information or clarification for what I said. Thank you for your time!

  • I have covered API and service contact - why we should use point, and I'll update more data for how and Why o-Auth Jan 4, 2019 at 13:29

3 Answers 3


I will be trying to make an answer quite simple for you to see through Magento a bit more fluently. (background, there is a lot of documentation and a couple of sentences may guide you to understand what is what..)

Magento is an e-commerce framework (php code and connect to mysql).

In steps:

  1. you may deploy this framework with simple data (in this process, you do have to setup a webserver indeed)
  2. you have at this point an ecommerce website that you can use: purchase items and create customer and so on (I understand this is not something you are interested but just to make it clear, this is what most people use Magento for). Also, anybody using this site will be able to create orders, register as a new customer like we do onto a site. By doing this the sample data are modified and your API queries can have different returned data
  3. finally, with just setting up the API (add an API user in the backend for querying some Magento API with a token), you have now access to all the Magento API to gather the data that the website host in its mysql database

--> you can create as many API users as you want and each can have different privileges (access different API)

--> the data that you will receive from these API calls will be the data in your mysql database and therefore will be the data related to the sample data (2k products, 1 customer and 2 orders are the content pretty much of the sample data)

I hope this clarify your situation. I don't see what you call "your users' own Magento data" and therefore I hope you see now that the data in the Magento API are only reflecting the e-commerce data you have in your site.

  • Thank you for laying that out more for me! Each of our users would have a different Magento website because our users often have no relation to other users other than referring them to use the website. Am I able to get data from each users individual site/db or is this not how the API is to be used or would it be too much work? I get the impression that the API is used mostly for internal use by whoever owns a single magento site versus an API such as Facebook Ads that allows us to get data on behalf of any authenticated user Jan 3, 2019 at 20:25
  • Of course, in fact your data for each user would be completely separate. Database could sit on different servers.. Jan 3, 2019 at 22:00
  • So to use the API we have to store the users data or can we just make requests to API to fufill a request? Say a user of mine wants to see daily breakdown of profit on all items across site over a month span, is this possible? We try not to store users data unless absolutely necessary for privacy reasons as well as to maintain a low overhead. I imagine a user can have a lot of data in their DB so we would rather make API requests to get data instead of storing it. Jan 3, 2019 at 22:11
  • I will try to answer accurately tomorrow. Now, some API are public and therefore can be called without user setup. Some API have restrictions (for good reasons that is as otherwise your site could be hacked with API calls and it would be one more thing to maintain server wise). For these you need a API user but the user’s data do not have to be real user data. Instead each user gets assigned some tokens and these are the sensitive data that are used after Jan 3, 2019 at 22:24

Let's go with API first - In general, the purpose of a repository is to hide the storage related logic.

Why and Where to use it.

  • A client of a repository should not care whether the returned entity is held in memory in an array, is retrieved from a MySQL database, fetched from a remote API or from a file.
  • If a third party module use only the repositories, Magento can change how and where data is stored, and the module will continue to work, despite these deep changes.
  • Repositories generally have methods like findById(), findByName(), put() or remove().
  • In Magento these commonly are called getbyId(), save() and delete(), not even pretending they are doing anything else but wrap CRUD DB operations.

Magento 2 repository methods can easily be exposed as API resources, making them valuable for integrations with third party systems or headless Magento instances.

  • With service contracts usage (Api/Data interfaces), it will be possible to expose custom module functionality as web API just by adding config etc/webapi.xml
  • Improved capabilities for integration with 3rd party systems based on service contracts will be added in the future, as well as queue support.
  • If there is another module dependent on your module, it can just rely on service interfaces. This reduces coupling between modules and minimizes risk of accidental breaking of dependent module.

enter image description here

Now when should I create Api/Data interfaces, repository interfaces in this case if it is needed?

  • Service contracts enhance the modularity of Magento. They enable Magento and third-party developers to report system dependencies through composer.json files and, consequently, guarantee compatibility among Magento versions. This compatibility ensures that merchants can easily upgrade Magento.
  • Data entities are a side benefit of service contracts. The database tables that normally support these entities can be complicated. For example, some attributes might be stored in an EAV table, so a set of MySQL database tables might define a single data entity . Data entities in a service contract reveal a simpler data model than the data model in an underlying relational database schema . Eventually, you will be able to use different storage technologies for different data collections. For example, you could use a NoSQL database to replace product tables.
  • Using the @api tag - Backward compatibility can be indicated by the use of @api. For more information, see Backward compatibility.

Magento 2 Api/Data, When To Create It?

As always, the answer is “It depends”. (In Vinai Kopp's words)

  1. If your entities will be used by other modules, then yes, you probably want to add a repository.
  2. There is another factor that should be added into the equation: in Magento 2, repositories can easily be exposed as Web API - that is REST and SOAP - resources.
  3. If that is interesting to you because of third party system integrations or a headless Magento setup, then again, yes, you probably want to add a repository for your entity.

For more Information

  1. https://devdocs.magento.com/guides/v2.0/extension-dev-guide/service-contracts/service-contracts.html
  2. https://devdocs.magento.com/guides/v2.0/extension-dev-guide/service-contracts/service-to-web-service.html
  3. http://vinaikopp.com/2017/02/18/magento2_repositories_interfaces_and_webapi/

Not let's go for HOW ?

Open the System > Extensions > Integrations

enter image description here

Add New Integration

enter image description here

Set the integration Name and other settings, then specify your Magento 2 back-end password in the Your Password field

enter image description here

Switch to the API sidebar tab and select the resources which will be available to OAuth clients:

enter image description here

Press the Save button. The integration will be saved and the Integrations list will be shown again. Press the Activate link in the integration row:

enter image description here

A confirmation screen will be shown. Press the Allow button

enter image description here

The credentials screen will be shown. Use them in your third-party software to access your Magento 2 as OAuth server.

You will see:

  • Consumer Key
  • Consumer Secret
  • Access Token
  • Access Token Secret

Copy it to somewhere, then press the Done button.

enter image description here

The integration will be saved and the Integrations list will be shown again. You will see your integration in the Active state: enter image description here

  • Thank you for the overview but that didn't exactly answer my first question which was most important. My application has many different users with different Magento accounts that aren't related at all. Is it possible for my application to get data for each separate user via the API? I'm getting the impression that the API is meant to be used within one company Jan 11, 2019 at 16:56

Will the API allow each one our users to authenticate to their own Magento data?

If I understand your question correctly.

  1. Your customer (user) has a magento 2 website.
  2. You need your user to grant access to their data so you can display on your Dashboard (Your Application)

The answer is a big YES,

Many companies are doing that way like:

  1. https://marketplace.magento.com/zonos-checkout.html
  2. https://www.taxjar.com/guides/integrations/magento2/

You can build your own magento 2 integration extension and publish it to magento marketplace for driving users to your dashboard.

If you need more detail of about developing a magento 2 integration extension, you can refer a blog I made pretty detail here:

Create an Integration in Magento 2 for Your APPLICATION

I really hope it helped.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.