"API key or signature invalid" when creating products with API

English Other stuff
#1

Hi,
We have a shop created before 2016 with access to API on NA platform.

I am trying to create products through the API, using existing designs from the user account. My code is based on the sample found here: https://developer.spreadshirt.net/display/API/Creating+Products+on+Spreadshirt+using+Spreadshirt+API+v1

I managed to create a valid Session ID with the email login and password, but when I try to create products I get a 401 Unauthorized error

HTTP/1.1 401 Unauthorized|
||Content-Type: application/xml;charset=utf-8|
||Server: nginx/9.5|
||Accept-Ranges: bytes|
||Via: 1.1 varnish|
||Content-Length: 118|
||Accept-Ranges: bytes|
||Date: Tue, 04 Jun 2019 05:12:31 GMT|
||Via: 1.1 varnish|
||Connection: keep-alive|
||X-Served-By: cache-dfw18629-DFW, cache-bwi5047-BWI|
||X-Cache: MISS, MISS|
||X-Cache-Hits: 0, 0|
||X-Timer: S1559625152.574110,VS0,VE41|
||X-Trace-Id: 93d0f854d903c6329b290e7f9b1ae4e4191ded8d|
||X-Application: api|
||Server-Timing: PASS, fastly;desc="Edge time";dur=41|
||Timing-Allow-Origin: *|
||X-Robots-Tag: noindex, nofollow|
|||
||<?xml version="1.0" encoding="UTF-8" standalone="yes"?><error><message>API key or signature invalid.</message></error>|

Signature looks like this:
|Authorization: SprdAuth apiKey="xxxxxxxx", data="POST https://api.spreadshirt.com/api/v1/users/790117/products?apiKey=xxxxxxxxxxxxxx 155962515xxxx", sig="ec6ff5f8189849ec20e6b6ec94c8ed04caxxxxxx", sessionId="615225cd-d347-45ab-8a7d-xxxxx"

Here’s my code:
https://pastebin.com/BEk58Fth

and the xml payload:
https://pastebin.com/Jrd6h47s

What am I doing wrong?

#2

You saw that post and pastebins, right?

#3

Yes I saw the posts, but I still don’t understand why my code is not working :frowning:

#4

Yes, but you didn’t see them in-deep :wink: kidding

Anyway, you need to send the auth-header to each of the requests:

you do:
curl_setopt($ch, CURLOPT_HEADER, false);
instead of
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);

the api key is not required in the url parameters, but the previously created authorization header.
This should solve the auth issue.

Please try that code below, because you don’t need the shop resource:
https://pastebin.com/erK97gPG

2 Likes