Authorize a store, test requests in the online console, or call the same platform endpoint from your backend. Free includes 20 calls per platform per day.
These docs are written for technical teams integrating commerce systems through Muvexa API.
Authorize a store, test requests in the online console, or call the same platform endpoint from your backend. Free includes 20 calls per platform per day.
Create a Muvexa account, open the console, and generate a store authorization link. After authorization, Muvexa issues a store-scoped credential pair: an API Key and an API Secret. Both live on the store management page, masked by default — click the eye icon to reveal or copy.
For testing, use the online API Console to send marketplace requests and inspect status, latency and response metadata.
POST https://openapi.muvexa.co/amazon/execute
Content-Type: application/json
X-Api-Key: <your-api-key>
X-Timestamp: 1723795200000
X-Nonce: 7b1f2d0c-5b52-4c74-a615-0d7e3cce8e9c
X-Signature: <hmac-sha256-hex>
{
"method": "GET",
"path": "/orders/v0/orders",
"queryParams": {
"MarketplaceIds": "ATVPDKIKX0DER",
"CreatedAfter": "2026-08-01T00:00:00Z"
}
}Use the store API Key from your backend to call the platform endpoint. This is available on Free and Pro; the plan determines the call quota.
Each marketplace has one stable Muvexa endpoint. The request contract stays the same across platforms.
Muvexa API
POST https://openapi.muvexa.co/amazon/execute
Connected commerce platforms
Managed by Muvexa APIEvery server-to-server request must be signed with the API Secret shown in the console. X-Api-Key is sent in plaintext; API Secret is never sent.
Join the six parts with a single newline, in this exact order. Every hex output is lowercase.
HTTP_METHOD + "\n" + // POST
REQUEST_PATH + "\n" + // /amazon/execute (路径，不含域名与查询串)
QUERY_STRING + "\n" + // 网关侧查询串，通常为空行
SHA256_HEX(raw_body) + "\n" + // 原始请求体字节的 SHA-256，小写十六进制
X_TIMESTAMP + "\n" + // 毫秒级 Unix 时间戳
X_NONCE // 本次请求唯一的随机串
X-Signature = HEX(HMAC_SHA256(stringToSign, apiSecret))Send all four headers on every request. API Secret is used only to compute the signature locally and never leaves your server.
POST https://openapi.muvexa.co/amazon/execute
Content-Type: application/json
X-Api-Key: <your-api-key>
X-Timestamp: 1723795200000
X-Nonce: 7b1f2d0c-5b52-4c74-a615-0d7e3cce8e9c
X-Signature: <hmac-sha256-hex>Nearly every INVALID_SIGNATURE report traces back to one of these four.
API integration is available on Free and Pro. Send X-Api-Key and signature headers, then send the target marketplace request to its platform endpoint.
Describe the commerce API call you want to make. queryParams become URL parameters, while body is sent as the JSON request body. Fill both according to the connected platform documentation; Muvexa does not inject or rewrite business fields.
{
"method": "GET",
"path": "/orders/v0/orders",
"queryParams": {
"MarketplaceIds": "ATVPDKIKX0DER",
"CreatedAfter": "2026-08-01T00:00:00Z"
}
}Endpoints such as report creation require reportType and marketplaceIds in body. Do not move them into queryParams.
{
"method": "POST",
"path": "/reports/2021-06-30/reports",
"body": {
"reportType": "GET_MERCHANT_LISTINGS_ALL_DATA",
"marketplaceIds": ["ATVPDKIKX0DER"]
}
}What you get back is the connected platform's own response body with its original status code. Muvexa keeps the response contract transparent.
{
"payload": {
"Orders": [
{
"OrderId": "902-0000000-0000000",
"OrderStatus": "Shipped",
"PurchaseDate": "2026-08-14T09:12:33Z",
"OrderTotal": { "CurrencyCode": "USD", "Amount": "42.50" }
}
],
"NextToken": "MRjLDgAAAAA..."
}
}Only rejections raised by Muvexa itself use this envelope: invalid parameters, invalid key or signature, and exhausted quota. Marketplace errors are passed through untouched, so the body is the marketplace's own error payload.
{
"code": 429,
"msg": "当日调用额度已用尽",
"data": null
}The same signed request in Python, Java, TypeScript, Go and cURL. Each sample is self-contained and uses only the standard library.
import hashlib, hmac, json, os, time, uuid
from urllib.parse import urlsplit
import requests
ENDPOINT = "https://openapi.muvexa.co/amazon/execute"
API_KEY = os.environ["MUVEXA_API_KEY"]
API_SECRET = os.environ["MUVEXA_API_SECRET"]
# 只序列化一次：下面签的和发的是同一串字节
payload = {
"method": "GET",
"path": "/orders/v0/orders",
"queryParams": {"MarketplaceIds": "ATVPDKIKX0DER", "CreatedAfter": "2026-08-01T00:00:00Z"},
}
body = json.dumps(payload, separators=(",", ":")).encode("utf-8")
timestamp = str(int(time.time() * 1000))
nonce = str(uuid.uuid4())
string_to_sign = "\n".join([
"POST",
urlsplit(ENDPOINT).path,
"", # 查询串为空
hashlib.sha256(body).hexdigest(),
timestamp,
nonce,
])
signature = hmac.new(
API_SECRET.encode("utf-8"), string_to_sign.encode("utf-8"), hashlib.sha256
).hexdigest()
res = requests.post(
ENDPOINT,
headers={
"Content-Type": "application/json",
"X-Api-Key": API_KEY,
"X-Timestamp": timestamp,
"X-Nonce": nonce,
"X-Signature": signature,
},
data=body, # 传 data=body，不要用 json=payload（会重新序列化）
timeout=60,
)
print(res.status_code, res.text)There is no Muvexa SDK yet, so these samples call the endpoint over plain HTTP. Read the API Key and API Secret from environment variables or your secret manager, never from source control.
A 401 response carries a code field that names the exact cause. Other status codes are passed through from the marketplace unchanged.
| Code | Meaning |
|---|---|
| INVALID_API_KEY | The API Key does not exist, has been revoked, or has no API Secret configured. |
| MISSING_SIGNATURE | One of X-Timestamp, X-Nonce or X-Signature is missing or blank. |
| INVALID_TIMESTAMP | X-Timestamp is not a number or falls outside the allowed time window. Check your server clock first. |
| DUPLICATE_NONCE | This X-Nonce was already used with the same API Key inside the nonce window. Generate a new one per request. |
| INVALID_SIGNATURE | The signature does not match. Compare your canonical string against the reference above, line by line. |
This platform does not collect, store or expose buyer personally identifiable information (PII).