The PrestaShop API is the set of interfaces through which external systems — ERP, warehouses, marketplaces, linkers, mobile apps — talk to the store without touching the admin panel. Without an API there is no automation: stock levels will not synchronise with Allegro, invoices will not flow into accounting, and marketplace orders will be entered by hand. PrestaShop offers two API worlds today: the classic Webservice (CRUD, API key) available forever, and the new Admin API (OAuth, CQRS) developed since version 9. An API integration usually costs 2,000–12,000 PLN net, depending on the number of systems and the complexity of data mapping.
Najważniejsze: The PrestaShop API is two interfaces: the classic Webservice API (CRUD on resources: products, orders, customers, stock_availables — with an API key and permissions) and the new Admin API (OAuth, CQRS endpoints, developed since PrestaShop 9). Typical integrations: Baselinker and marketplaces (Allegro, Amazon), ERP and warehouses (Subiekt, Comarch, WMS), couriers and payments, BI and data warehouses. Integration cost: 2,000–12,000 PLN net. Security rules: least-privilege keys, HTTPS, IP whitelisting, logging and monitoring.
Webservice API — the classic that still powers integrations
The classic PrestaShop Webservice is REST-style CRUD on store resources. It works in every version and covers almost all typical integrations.
- Resources —
products,categories,combinations,stock_availables,orders,customers,carts,invoices,manufacturers,suppliersand dozens more. - Authorisation — an API key created in the panel (Advanced Parameters > Webservice), with granular per-resource permissions (GET/POST/PUT/DELETE) — grant only what the integration needs.
- Format — XML by default, JSON with
?output_format=JSON(or via header). - Uses — product and stock imports/updates, pulling orders into ERP, customer synchronisation, invoice generation, sales-linker integrations.
Limitations of the classic Webservice: no modern authentication, XML "beauty", performance on bulk operations (tens of thousands of products require batched imports outside peak hours) and no events — the client must poll, unless you build webhooks on the store side.
Admin API — the new generation (PrestaShop 9+)
Since PrestaShop 9 the Admin API is being developed: OAuth authentication, CQRS-style endpoints, a more domain-oriented approach. It is the foundation for modern integrations and headless commerce.
-
OAuth instead of keys — the industry standard, better for SaaS integrations.
-
Domain endpoints — operations described in process language (orders, products), not raw tables.
-
Parallel development — the classic Webservice remains supported; plan new projects with the Admin API in mind, but the decision depends on what the system on the other side supports.
-
Practical note: the integration ecosystem (Baselinker, ERP, modules) still largely relies on the classic Webservice — before a project, check what your partner actually supports.
Typical PrestaShop API integrations
| Integration | Data direction | Key challenges |
|---|---|---|
| Baselinker / linkers | Orders ↔ store, stock ← warehouse | Status mapping, duplicate orders |
| Allegro / marketplaces | Offers, stock, prices, orders | Marketplace API limits, overselling |
| ERP (Subiekt, Comarch) | Products, stock, orders, invoices | Field mapping, units of measure, VAT |
| WMS / warehouse | Stock, reservations, shipments | Real time, stock conflicts |
| Couriers and payments | Labels, statuses, refunds | Webhooks, idempotency |
| BI / reporting | Sales, carts, products | Database load — read from a replica or exports |
On building resilient integrations (queues, retries, idempotency, monitoring) see resilient API and webhook integrations, and on connecting sales into one hub — sales automation with API and Baselinker.
API security — rules you cannot skip
- Least privilege — a separate key per integration, only the needed resources and methods. An "everything" key is an invitation to disaster.
- HTTPS and IP whitelisting — the Webservice should be reachable only over HTTPS, ideally restricted to the partner's IPs.
- Do not log personal data — integration logs must not contain full customer data; mask and retain per GDPR.
- Monitoring and alerts — hours without stock synchronisation means potential overselling and complaints; the integration needs monitoring and alerts.
- Updates and tests — after every PrestaShop and module update, test the key API flows; core changes can alter resource behaviour.
How much does an API integration cost?
| Scope | Price (net) |
|---|---|
| Simple integration (one source → store, e.g. stock) | 2,000–4,000 PLN |
| Two-way integration (marketplace, ERP) | 4,000–8,000 PLN |
| Complex hub (several systems, queues, monitoring) | 8,000–20,000 PLN+ |
| Integration maintenance | from 300 PLN/month |
When planning, remember the cost is not only code: data mapping, tests at real volumes and maintenance after API changes on both sides. If there are several integrations, one hub (linker) is usually cheaper than three separate connectors — we analyse before quoting.
Frequently asked questions
How do I enable the Webservice API in PrestaShop?
- In the panel: Advanced Parameters > Webservice, add a key, grant per-resource permissions (e.g. read orders, write stock), set an IP whitelist. The API address is
/api/on your domain. Treat the key like a password — keep it in a secrets manager, not in code.
Does PrestaShop 9 have a new API?
Yes — PrestaShop 9 develops the Admin API with OAuth and CQRS endpoints. The classic Webservice remains supported, so existing integrations keep working; consult your partner about the target interface for new projects.
How do I synchronise stock levels with Allegro?
Through the PrestaShop API (reading stock) and the Allegro API (updating offers) — directly or via a linker like Baselinker. Key points: synchronisation frequency, reservation handling and overselling protection. Practical guide: Allegro + PrestaShop.
Is the PrestaShop API secure?
The key-and-permissions mechanism is sufficient if the rules are followed: least privilege, HTTPS, IP whitelisting, separate keys per integration, rotation and monitoring. The biggest risks are key leaks from code and excessive permissions.
How many products can be synchronised through the API?
Tens of thousands — but bulk operations must run in batches, with throttling and outside peak hours. The classic Webservice dislikes mass writes during traffic; for large catalogues we plan incremental imports and queuing.
Can we build the API integration ourselves?
Simple flows (order exports, stock updates) are within reach of a capable team. Integrations critical to sales — with idempotency, retries, monitoring and error handling — are better entrusted to an experienced vendor: a synchronisation failure costs more than building it.
Sources and tools
- PrestaShop DevDocs — Webservice API
- PrestaShop DevDocs — Admin API
- PrestaShop DevDocs — developer documentation
- Baselinker — integration documentation
- OWASP — API security
👉 Need to connect your store with ERP, marketplaces or couriers? See e-commerce integrations and PrestaShop store development in my offer: PrestaShop API, webhooks, queues, monitoring and integration maintenance. Get in touch via the contact form or at kontakt@informatix.com.pl.
👉 Automating sales? Check resilient API and webhook integrations, PrestaShop developer and Allegro + PrestaShop.
📖 See also: PrestaShop implementation, PrestaShop online store and e-commerce integrations.