Changes to API Usage

For those of you making use of the Public API, there’ll be a few important changes coming first thing in 2018. This article will tell you everything you need to know.

Here’s a quick overview of what’s happening: at the beginning of the year 2018. All applications using our API need to …

• be run through HTTPS
• use the official domains api.spreadshirt.com (North-American platforms) and api.spreadshirt.net (EU platforms)
• transmit a valid API key
• provide a user agent

HTTPS

It’s for the sake of safety. All API requests need to go through HTTPS in future. HTTP requests will then be redirected to HTTPS.

Official Domains

All requests will need to go through our official domains api.spreadshirt.net and api.spreadshirt.com – all other channels for using the API will be closed. As a safety precaution, we may also block access of unofficial routes.

API Key

All applications issuing API requests need to transmit a valid API-Key. The easiest was to do this is by adding a query parameter along with the API key to each URL. An example:

https://api.spreadshirt.net/api/v1/shops/205909?apiKey=8e5bb312-9060-446f-ada2-8c319327745a

This option will still be supported, but it’s not a recommendation.

Better still is using the authorization header in place here (https://developer.spreadshirt.net/display/API/Security), as for example:

• https://api.spreadshirt.net/api/v1/shops/205909
• Authorization: SprdAuth apiKey=”8e5bb312-9060-446f-ada2-8c319327745a”

Communication through HTTPS will also transmit the header encrypted.

API keys for European and North-American platforms are available here:

• https://www.spreadshirt.de/-C7120
• https://www.spreadshirt.com/-C6840

User Agent

All browser applications need to transmit an additional user agent in future, so that the API user can be identified. The user agent needs to look like this:

User agent: <YourApplication>/<YourAppVersion> (https://www.yourdomain.com; yourname@yourdomain.com)

This is an example of a user agent:

User agent: WordPress-Plugin/1.0 (https://www.deinblog.com; admin@deinblog.com)

If you use our API, please provide us with a) the name of the application, b) the version of the application, and c) the administrators email address. This is important so we can get in touch when it should it be necessary.

We hope that you’re just as happy with the changes as we are. Please refer any questions and feedback you have with us.