# How to connect to Shopware

To connect your Shopware shop, you create an **Integration** in your Shopware Administration and enter its keys, together with your shop's domain, in Vault. There is no sign-in or consent screen: Apideck uses the Integration's keys to request access tokens for your shop.

## Prerequisites

- A Shopware 6 shop (self-hosted or cloud) that is reachable at its own domain.
- A user in the shop's Administration who can open **Settings > System > Integrations** and create an integration.

## Optional: limit access with a role

If you prefer not to give the integration Administrator access, create a role before you create the integration, then select it in step 4 of the next section.

1. Go to **Settings > System > Users & Permissions > Roles**.
2. Select **Create new role**.

![create-new-role](https://res.cloudinary.com/apideck/image/upload/v1752064032/docs/connectors/shopware/shopware-create-new-role.png)

3. Grant access to the areas the integration needs to read, such as orders, products, customers and the shop settings. Apideck also registers and removes webhooks in your shop through the API, so the role must also allow webhook management. Each area has **View**, **Edit**, **Create** and **Delete** permissions; selecting **All** for these areas is the simplest option. Save the role.

![assign-permissions](https://res.cloudinary.com/apideck/image/upload/v1752064032/docs/connectors/shopware/shopware-permissions.png)

A role-limited integration can only reach the areas its role allows. If some data or webhook events are missing after you connect, widen the role or switch the integration to Administrator. See [Users & Permissions (Shopware documentation)](https://docs.shopware.com/en/shopware-6-en/settings/system/user).

## 1. Create an integration

1. In your Shopware Administration, go to **Settings > System > Integrations**.
2. Click **Add integration**.
3. Enter a **Name**, for example "Apideck".
4. Set the permissions:
   - Turn on the **Administrator** toggle to give the integration full access (this is the setup Shopware's developer guide uses), **or**
   - Select a restricted role instead (see [Optional: limit access with a role](#optional-limit-access-with-a-role)).
5. **Copy the Access key ID and the Secret access key and store them safely.** The secret is displayed only once, when the integration is created. You will enter both in Vault.
6. Save the integration.

![create-integration](https://res.cloudinary.com/apideck/image/upload/v1752064032/docs/connectors/shopware/shopware-create-integration.png)

Shopware's own instructions: [Integrations (Shopware documentation)](https://docs.shopware.com/en/shopware-6-en/settings/system/integrationen) and [Admin API: integrations and authentication](https://developer.shopware.com/docs/guides/development/integrations-api/).

## 2. Find your shop domain

The Shop Domain is the host of the shop that serves the Shopware Admin API (the API lives at `https://your-shop-domain/api`).

1. In the sidebar, go to **Settings > System > Sales Channels**.
2. Click the sales channel you are interested in (for example "Storefront").
3. In the channel's detail view, open the **Domains** tab to see the domain entries.

Enter the host only, without `https://` and without a path, for example `myshop.example.com`.

If your storefront runs on a separate frontend (a headless setup), use the domain of the Shopware backend, not the frontend's domain: a frontend host does not answer Admin API requests, so the connection fails.

## 3. Authorize the connection in Vault

Open Shopware in Vault and fill in:

| Vault field | What to enter |
| --- | --- |
| **Shop Domain** | Your shop's host, for example `myshop.example.com` (Vault already shows the `https://` prefix) |
| **Client ID** | The integration's **Access key ID** |
| **Client Secret** | The integration's **Secret access key** |

Then save and authorize the connection.

![connection-settings](https://res.cloudinary.com/apideck/image/upload/v1752064032/docs/connectors/shopware/shopware-connection-settings.png)

## Notes

- **The keys belong to one shop.** Keys from one Shopware shop (including a test or development shop) do not work on another shop. Create a separate integration in each shop you want to connect.
- **Regenerating keys breaks the connection.** In Shopware, **Regenerate API access key** replaces both the Access key ID and the Secret access key. After regenerating, enter the new pair in Vault.

## Troubleshooting: no data returned

If your Shopware connection shows as **connected** in Vault but list calls return no data, or fail with an unexpected error, the request may be blocked **before it reaches your store**, by an edge or security layer in front of your shop. This is not an Apideck or credentials problem.

### How to recognise an edge block

- The error body is **HTML (or plain text), not JSON**. Shopware's API returns JSON for real errors; an HTML page means the request was answered by an edge layer before reaching the store.
- The response headers name an **edge layer** (for example `server: cloudflare` with a `cf-ray` id) rather than the Shopware application.
- A **direct call** from your own machine to the same store URL returns the **same** block, confirming it happens at your store's edge, independent of Apideck.

### Make sure your shop is reachable from Apideck

Apideck's static IPs for the EU Central 1 region (`eu-central-1`) are listed below. If your shop's domain does not respond, check with your hosting provider (or Shopware, for cloud shops) whether a firewall, CDN or WAF, or a regional restriction sits in front of the shop, and make sure requests from the IP addresses below are allowed.

### How to fix it (self-hosted or customer-controlled edge)

1. **Allowlist Apideck's static egress IPs** on your firewall or Cloudflare, or add a "skip / allow" rule scoped to your store's API path. Apideck's EU (`eu-central-1`) egress IPs are:
   - `18.197.244.247`
   - `18.156.9.3`
   - `3.65.139.215`

   Static IPs for other regions are upcoming.

2. **Check which rule fired.** In Cloudflare, open **Security > Events** and search for the `cf-ray` value from the error: it names the exact rule that blocked the request.

### Important: allowlisting IPs is not always enough

On Cloudflare, several protections still block an allowlisted IP. If requests are still blocked after allowlisting, check for **Bot Fight Mode** (not bypassable by IP rules), **Browser Integrity Check** (blocks non-browser User-Agents), **managed / custom WAF rules**, **JA3/JA4 TLS fingerprinting**, and **rate limiting**.

### Why the connection still shows "connected"

Apideck relays your store's error exactly as received. A `403` is **not** retried automatically and does **not** mark the connection as disconnected, so the connection stays healthy while individual data calls fail. Transient edge blocks often clear on **retry a little later**; to stop them recurring, apply the changes above.