# How to connect to Magento

To create a connection with Magento, you need to create an 'Integration' in your store's Admin by completing the following steps.

Note: This looks like a lot of steps, but they are all quite simple and we're providing screenshots of each to make it as clear as possible.

## Prerequisites

- A **Magento Open Source 2.x** store, or an **Adobe Commerce 2.x** store running on-premises or on Adobe's cloud infrastructure (PaaS).
- A Magento **Admin user** who can manage integrations. You will re-enter your Admin password when saving the integration.
- Your store's `/rest` endpoints must be reachable from the internet. If your store sits behind Cloudflare, a WAF or bot protection, see [Troubleshooting: no data returned](#troubleshooting-no-data-returned) below.

Adobe Commerce as a Cloud Service (SaaS) stores work differently: Adobe does not offer integration tokens there and uses Adobe IMS OAuth 2 instead, so they cannot use this connection method. The steps below apply to Open Source, on-premises and Adobe cloud-infrastructure (PaaS) stores.

For Adobe's own walkthrough of these screens, see [Adobe Commerce: Integrations](https://experienceleague.adobe.com/en/docs/commerce-admin/systems/integrations).

## Creating a new Magento Integration

1. After you've signed in as an Admin, from the left menu, select **System > Extensions > Integrations**.

![Magento: Step 1](https://res.cloudinary.com/apideck/image/upload/v1716384710/docs/connectors/magento/step-1-nav.png)

2. Select **Add New Integration**.

![Magento: Step 2](https://res.cloudinary.com/apideck/image/upload/v1716384711/docs/connectors/magento/step-2-integrations.png)

3. Enter a _Name_ and _Email_ for the integration and enter your Admin password. **Note: The Callback URL and Identity Link URL should be left blank.** Magento may label the integration "Integration not secure" because these URLs are empty; this is harmless for this connection, which does not use a redirect flow.

![Magento: Step 3](https://res.cloudinary.com/apideck/image/upload/v1716384712/docs/connectors/magento/step-3-new-integration.png)

4. _Before_ clicking **Save**, select **API** in the left panel to configure the integration permissions. Set **Resource Access** to **Custom** and make sure the following resources are selected (or set **Resource Access** to **All**):

- Sales
- Catalog
- Customers
- Stores > Settings > All Stores

These permissions are required to read your orders and shipments (Sales), products (Catalog), customers (Customers) and store settings (All Stores) from Magento. Customers access is also needed to validate the connection, so do not leave it out.

![Magento: Step 4](https://res.cloudinary.com/apideck/image/upload/v1716384712/docs/connectors/magento/step-4-permissions.png)

5. Click **Save**. The new integration is listed as **Inactive**; activate it by clicking the **Activate** link in the table.

![Magento: Step 5](https://res.cloudinary.com/apideck/image/upload/v1716384713/docs/connectors/magento/step-5-activate.png)

6. Review the permissions you've assigned and click **Allow**.

![Magento: Step 6](https://res.cloudinary.com/apideck/image/upload/v1716384713/docs/connectors/magento/step-6-allow.png)

7. Now that your integration has been activated, you'll be presented with the **Consumer Key**, **Consumer Secret**, **Access Token**, and **Access Token Secret** in the Integration Tokens dialog. Copy all four values, then click **Done**. These are the credentials you'll use to connect to Magento.

![Magento: Step 7](https://res.cloudinary.com/apideck/image/upload/v1716384713/docs/connectors/magento/step-7-tokens.png)

## Vault Connection Setup

Now that you've created the Integration with access to your Magento data, you can fill out your credentials in Vault. All six fields are required:

- **Shop Name**
- **Magento Rest API Domain**: the domain that hosts your REST API. The `https://` prefix is already filled in, and the domain should not include the `/rest/V1/` suffix as this is added automatically.
- **Consumer Key**
- **Consumer Secret**
- **Access Token**
- **Access Token Secret**

![Vault Magento Tokens](https://res.cloudinary.com/apideck/image/upload/v1716384714/docs/connectors/magento/step-8-connection.png)

Click **Save** after completing the form. If all fields are correctly entered, Vault will validate the connection credentials and indicate it is now **connected**.

![Vault Magento Connected](https://res.cloudinary.com/apideck/image/upload/v1716384715/docs/connectors/magento/step-9-connected.png)

Your Magento Integration is now connected.

## Notes

- **One connection per store.** Each Magento store has its own API domain, so connect each store separately.
- **Tokens do not expire.** Magento integration tokens stay valid until they are manually revoked, so you do not need to renew them.
- **Rotating credentials.** To issue a new Access Token and Access Token Secret, click **Reauthorize** on the active integration in **System > Extensions > Integrations**, then update the two values in Vault. See [Adobe Commerce: integration tokens](https://developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-token) for background.
- **No redirect URL needed.** The connection uses the four integration credentials directly, so nothing needs to be registered as a callback in Magento.

## Troubleshooting: connection fails to validate

If Vault does not show the connection as **connected** after saving:

- Check that the **Magento Rest API Domain** is the bare domain: do not type `https://` again and do not add the `/rest/V1/` suffix.
- Check that all four tokens were copied completely and pasted into the matching fields.
- Check that the integration is **Active** and has **Customers** access, which the connection needs to validate.
- If your store is behind Cloudflare or a WAF, the validation call itself can be blocked; see the section below.

## Troubleshooting: no data returned

If your Magento connection shows as **connected** in Vault but list calls (e.g. `products`, `orders`) return no data, or fail intermittently with `403`, `401`, or `400`, the request is most likely being blocked by a security layer **in front of your store**, before it reaches Magento's REST API. This is not an Apideck or credentials problem.

### How to recognise an edge block

- The error body is **HTML or plain text**, not Magento's usual JSON error envelope. An HTML page means the request never reached Magento's API.
- The response headers name an **edge layer**: `server: cloudflare` with a `cf-ray` id (blocked at Cloudflare), sometimes with a `www-authenticate: BASIC` challenge (an HTTP Basic-auth gate in front of the API) or CDN/commerce-platform session cookies.
- A **direct call** from your own machine to the same URL (e.g. `https://yourstore.com/rest/V1/products?...`) returns the **same** block, confirming it happens at your store's edge, independent of Apideck.
- Note: a `504` or Cloudflare `520` is different: those point at your **origin/host** being slow or unreachable (share the Cloudflare Ray ID with your hosting provider to pull the server logs).

### How to fix it

1. **Allowlist Apideck's static egress IPs** on your firewall / Cloudflare, or add a "skip / allow" rule scoped to the Magento REST paths **`/rest/V1/*`** (and `/rest/*`). Apideck's EU (eu-central-1) egress IPs are:
   - `18.197.244.247`
   - `18.156.9.3`
   - `3.65.139.215`

   These are Apideck's current EU (`eu-central-1`) egress IPs; support for other regions is upcoming. If you need to confirm the latest list for your region, contact [Apideck Support](https://help.apideck.com/en/articles/7774658).

2. **Check which rule fired.** In Cloudflare, open **Security → Events** and search for the `cf-ray` value from the error: it names the exact rule that blocked the request.

### Important: allowlisting IPs is not always enough

On Cloudflare, several protections still block an allowlisted IP. If requests are still blocked after allowlisting, check these:

- **Bot Fight Mode**: cannot be bypassed by IP rules or a WAF skip; turn it off or scope it away from `/rest/*`.
- **Browser Integrity Check**: blocks non-browser clients by User-Agent; disable it for `/rest/*` via Configuration Rules.
- **Managed / custom WAF rules** on `/rest/*`.
- **JA3/JA4 TLS fingerprinting** and **rate limiting**.

### Why the connection still shows "connected"

Apideck relays your store's error exactly as received. A `403` is **not** retried automatically and does **not** mark the connection as disconnected, so the connection stays healthy while individual data calls fail. Because these edge blocks are often transient, **retrying a little later frequently succeeds**. To stop them recurring, apply the allowlist / rule changes above.