An API token identifies your integration to the store. Its settings decide where requests can come from, whether they must be signed, and which functions they can run.
Create the token#
- In the Miva admin, go to Users > API Tokens.
- Add a new token.
- Set the IP address list (see below).
- Turn on the HMAC signature requirement and choose SHA256. Miva generates a signing key for the token.
- Turn on the timestamp requirement if you want replay protection. Requests then have to arrive within 30 seconds of the
Miva_Request_Timestampthey carry. - Save the token.
Copy two values from the token:
| Value | Used for |
|---|---|
| Access token | Sent in the X-Miva-API-Authorization header of every request |
| Signing key | A Base64 string you use to sign requests. Copy it exactly as shown. |
Treat both like passwords. Keep them on the server side of your integration, out of source control and out of browser JavaScript.
Testing your first request
Make your first API request starts with an unsigned request so you can check the token and permissions before adding signing code. For that test, use a token with the signature requirement off, then switch to a signed token for anything real.
Restrict IP addresses#
Each token accepts requests only from the addresses you list. Enter a comma-separated list of IP addresses or ranges.
If your integration doesn’t have a static IP address, 0.0.0.0/0 allows any IPv4 address and ::/0 allows any IPv6 address.
Security warning
Keep the IP restriction on whenever you can. Only open it to every address when you have no fixed address or range to list.
Give the token permissions#
A new token can’t run any functions until you give it some. Select the token in the API Tokens list to see the Groups and Functions buttons.
Groups : The token gets every function the group allows. These are the same groups you assign to admin users.
Functions : Add individual functions by name, marked as domain-level or store-level. For the first request in this guide, add ProductList_Load_Query.
You can use both. A module’s functions use this format:
Module:MODULE_CODE_HERE:MODULE_FUNCTION_HERE