Admin API and Webservice in PrestaShop 9: when to use each

For more than a decade, the way to talk to PrestaShop from outside has been the Webservice: a REST API with XML (or JSON) and one key per integration. PrestaShop 9 introduces a new Admin API, built on API Platform and with OAuth2 authentication. They coexist, and it is worth knowing which one to use.

The classic Webservice

• It is enabled in Advanced Parameters > Webservice, by creating a key with permissions per resource.
• Basic authentication with the key as the username.
• It covers almost the entire data model: products, combinations, orders, customers, stock…
• It is based on the core ObjectModel classes: what you save goes through the same validations as the old back office.

curl -u CLAVE: "https://tienda.com/api/products/12?output_format=JSON"

The Admin API

• OAuth2 authentication with client credentials: you request an access token and use it in the Authorization: Bearer header.
• Native JSON, automatically generated documentation and permissions by scopes.
• Its operations reuse the commands and queries (CQRS) of the new back office, so the logic is the same as in the Symfony screens.
• Its coverage grows with each version; in the first versions of PrestaShop 9 it does not reach all the resources the Webservice has.

Which one should I choose?

Tips for any integration

• One key or one client per integration, with the minimum permissions. If one leaks, you revoke it without touching the others.
• Always over HTTPS.
• Pagination and filters: do not request every order in history on each call.
• Log the calls on your side: when something does not add up, you will know what was sent and when.

Want to put this into practice in your store? Rekire can help: custom PrestaShop module development and PrestaShop technical support with hour packs.