Authentication Methods in Detail

The connector authenticates itself against the Shopware Admin API using OAuth and receives a bearer token that is used for all subsequent calls. There are two procedures, which you switch between using the Shopware Integration Access toggle.

Comparison of the Procedures

Integration access (recommended)

Integration Access toggle = enabled.

• You store the Access Key ID and Secret Access Key from a Shopware integration.
• Technically: grant_type = client_credentials.
• Advantage: not tied to a personal user, ideal for automated processes.

How to create an integration in Shopware: Administration → Settings → System → Integrations → Add integration. Copy the Access key ID and Secret access key.

Password grant

Integration Access toggle = disabled.

• You store the user name and password of a Shopware administrator.
• Technically: grant_type = password, client_id = administration.
• Advantage: quick to set up. Disadvantage: tied to one user and that user's password.

Recommendation: Use integration access for productive, automated operation. It is more stable and independent of user password changes.

Fields in the Configuration

Field	With integration access	With password grant
Shopware User Name	Access Key ID	User name
Shopware User Password	Secret Access Key	Password
Integration Access	enabled	disabled

Security

• Credentials are stored masked.
• The token is retrieved again automatically when required.
• Grant the integration in Shopware only the required permissions (write access to the relevant areas).

If you change the password of the administration user, the password grant fails until you store the new password. Integration access is not affected by this.

Frequently Asked Questions

Which endpoint and which grant type does the connector use to sign in?

Sign-in takes place at the oauth/token endpoint. With integration access, the connector uses grant_type=client_credentials with a client ID and client secret; with an admin user, it uses grant_type=password with client_id=administration, user name, and password. The bearer token that is returned is sent with all subsequent calls in the Authorization: Bearer {token} header and is renewed automatically when it expires.

What exactly does the "Test Connection" action check?

"Test Connection" internally calls the token sign-in (GetToken). If the token is retrieved successfully, the combination of Website URL, API Module Path, and credentials is correct. If it fails and the "Developer Log" is active, the connector logs the exact server response in the API Call Log.