Shoplive API Getting Started

// npm i jsonwebtoken
const jwt = require('jsonwebtoken');

function createShopliveToken(accessKey, base64SecretKey) {
  const key = Buffer.from(base64SecretKey, 'base64'); // sign with the decoded bytes
  return jwt.sign({ accessKey }, key, { algorithm: 'HS256', expiresIn: '365d' });
}

# pip install pyjwt
import base64, time, jwt

def create_shoplive_token(access_key: str, base64_secret_key: str) -> str:
    key = base64.b64decode(base64_secret_key)  # sign with the decoded bytes
    now = int(time.time())
    payload = {"accessKey": access_key, "iat": now, "exp": now + 365 * 24 * 3600}
    return jwt.encode(payload, key, algorithm="HS256")

// build.gradle: implementation 'io.jsonwebtoken:jjwt:0.9.1'
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.util.Date;

public class ShopliveToken {
    public static String create(String accessKey, String base64SecretKey) {
        long oneYear = 365L * 24 * 60 * 60 * 1000;
        return Jwts.builder()
            .signWith(SignatureAlgorithm.HS256, base64SecretKey) // string keys are treated as Base64
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + oneYear))
            .claim("accessKey", accessKey)
            .compact();
    }
}

// go get github.com/golang-jwt/jwt/v5
package shoplive

import (
	"encoding/base64"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

func CreateShopliveToken(accessKey, base64SecretKey string) (string, error) {
	key, err := base64.StdEncoding.DecodeString(base64SecretKey) // sign with the decoded bytes
	if err != nil {
		return "", err
	}
	now := time.Now()
	claims := jwt.MapClaims{
		"accessKey": accessKey,
		"iat":       now.Unix(),
		"exp":       now.Add(365 * 24 * time.Hour).Unix(),
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(key)
}

# gem install jwt
require 'jwt'
require 'base64'

def create_shoplive_token(access_key, base64_secret_key)
  key = Base64.decode64(base64_secret_key) # sign with the decoded bytes
  now = Time.now.to_i
  payload = { accessKey: access_key, iat: now, exp: now + 365 * 24 * 3600 }
  JWT.encode(payload, key, 'HS256')
end

async function syncProducts(products) {           // products: changed rows from your DB
  const created = await sl('POST', '/product', products);
  const existing = created.results
    .filter(r => r.status === 'FAIL')
    .map(r => products.find(p => p.customerProductId === r.customerProductId));
  const updated = existing.length ? await sl('PUT', '/product', existing) : { results: [] };
  return { created: created.successCount, updated: updated.successCount,
           failed: updated.results.filter(r => r.status === 'FAIL') };
}

async function sl(method, path, body) {
  const res = await fetch(`https://private.shopliveapi.com/v2/YOUR_ACCESS_KEY${path}`, {
    method, headers: { Authorization: `Bearer ${process.env.SL_TOKEN}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(body)
  });
  const text = await res.text();
  let data = null;
  try { data = JSON.parse(text); } catch {}   // the body may be empty or not JSON
  if (!res.ok || data?._s < 0) throw new Error(`${res.status} ${text}`);   // error if HTTP ≥ 400 or _s < 0 (see Error responses)
  return data;
}

import os, requests

BASE = "https://private.shopliveapi.com/v2/YOUR_ACCESS_KEY"
H = {"Authorization": f"Bearer {os.environ['SL_TOKEN']}", "Content-Type": "application/json"}

def sl(method, path, body):
    r = requests.request(method, BASE + path, json=body, headers=H, timeout=10)
    try:
        data = r.json()
    except ValueError:            # the body may be empty or not JSON
        data = None
    s = data.get("_s") if isinstance(data, dict) else None
    if r.status_code >= 400 or (isinstance(s, (int, float)) and s < 0):
        raise RuntimeError(f"{r.status_code} {r.text}")   # error if HTTP ≥ 400 or _s < 0 (see Error responses)
    return data

def sync_products(products):      # products: changed rows from your DB (list of dicts)
    created = sl("POST", "/product", products)
    by_id = {p["customerProductId"]: p for p in products}
    existing = [by_id[r["customerProductId"]] for r in created["results"]
                if r["status"] == "FAIL"]
    updated = sl("PUT", "/product", existing) if existing else {"results": [], "successCount": 0}
    return created["successCount"], updated["successCount"]

// build.gradle: implementation 'org.json:json:20240303'
import org.json.JSONArray;
import org.json.JSONObject;

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class ProductSync {
    static final HttpClient CLIENT = HttpClient.newHttpClient();

    static JSONObject syncProducts(JSONArray products) throws Exception {   // products: changed rows from your DB
        JSONObject created = sl("POST", "/product", products);
        JSONArray createdResults = created.getJSONArray("results");
        JSONArray existing = new JSONArray();
        for (int i = 0; i < createdResults.length(); i++) {
            JSONObject r = createdResults.getJSONObject(i);
            if ("FAIL".equals(r.getString("status"))) {
                String cid = r.getString("customerProductId");
                for (int j = 0; j < products.length(); j++) {
                    JSONObject p = products.getJSONObject(j);
                    if (cid.equals(p.getString("customerProductId"))) { existing.put(p); break; }
                }
            }
        }
        JSONObject updated = existing.length() > 0
            ? sl("PUT", "/product", existing)
            : new JSONObject().put("results", new JSONArray()).put("successCount", 0);
        JSONArray failed = new JSONArray();
        JSONArray updatedResults = updated.getJSONArray("results");
        for (int i = 0; i < updatedResults.length(); i++) {
            JSONObject r = updatedResults.getJSONObject(i);
            if ("FAIL".equals(r.getString("status"))) failed.put(r);
        }
        return new JSONObject()
            .put("created", created.getInt("successCount"))
            .put("updated", updated.getInt("successCount"))
            .put("failed", failed);
    }

    static JSONObject sl(String method, String path, Object body) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://private.shopliveapi.com/v2/YOUR_ACCESS_KEY" + path))
            .header("Authorization", "Bearer " + System.getenv("SL_TOKEN"))
            .header("Content-Type", "application/json")
            .method(method, HttpRequest.BodyPublishers.ofString(body.toString()))
            .build();
        HttpResponse<String> response = CLIENT.send(request, HttpResponse.BodyHandlers.ofString());
        String text = response.body() == null ? "" : response.body().trim();
        JSONObject json = text.startsWith("{") ? new JSONObject(text) : new JSONObject(); // the body may be empty or not JSON
        if (response.statusCode() >= 400 || json.optInt("_s", 0) < 0) {
            throw new RuntimeException(response.statusCode() + " " + text); // error if HTTP ≥ 400 or _s < 0 (see Error responses)
        }
        return json;
    }
}

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
)

type slResult struct {
	CustomerProductID string `json:"customerProductId"`
	Status             string `json:"status"`
}

type slResponse struct {
	S            int        `json:"_s"`
	Results      []slResult `json:"results"`
	SuccessCount int        `json:"successCount"`
}

// products: changed rows from your DB
func syncProducts(products []map[string]interface{}) (map[string]interface{}, error) {
	created, err := sl("POST", "/product", products)
	if err != nil {
		return nil, err
	}
	var existing []map[string]interface{}
	for _, r := range created.Results {
		if r.Status == "FAIL" {
			for _, p := range products {
				if p["customerProductId"] == r.CustomerProductID {
					existing = append(existing, p)
					break
				}
			}
		}
	}
	var updated slResponse
	if len(existing) > 0 {
		u, err := sl("PUT", "/product", existing)
		if err != nil {
			return nil, err
		}
		updated = *u
	}
	var failed []slResult
	for _, r := range updated.Results {
		if r.Status == "FAIL" {
			failed = append(failed, r)
		}
	}
	return map[string]interface{}{
		"created": created.SuccessCount,
		"updated": updated.SuccessCount,
		"failed":  failed,
	}, nil
}

func sl(method, path string, body interface{}) (*slResponse, error) {
	buf, err := json.Marshal(body)
	if err != nil {
		return nil, err
	}
	req, err := http.NewRequest(method, "https://private.shopliveapi.com/v2/YOUR_ACCESS_KEY"+path, bytes.NewReader(buf))
	if err != nil {
		return nil, err
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("SL_TOKEN"))
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		return nil, err
	}
	var out slResponse
	jsonErr := json.Unmarshal(data, &out) // the body may be empty or not JSON
	if res.StatusCode >= 400 || (jsonErr == nil && out.S < 0) {
		return nil, fmt.Errorf("%d %s", res.StatusCode, string(data)) // error if HTTP ≥ 400 or _s < 0 (see Error responses)
	}
	if jsonErr != nil {
		return nil, jsonErr
	}
	return &out, nil
}

require 'net/http'
require 'json'
require 'uri'

# products: changed rows from your DB
def sync_products(products)
  created = sl('POST', '/product', products)
  existing = created['results']
    .select { |r| r['status'] == 'FAIL' }
    .map { |r| products.find { |p| p['customerProductId'] == r['customerProductId'] } }
  updated = existing.any? ? sl('PUT', '/product', existing) : { 'results' => [], 'successCount' => 0 }
  {
    'created' => created['successCount'],
    'updated' => updated['successCount'],
    'failed' => updated['results'].select { |r| r['status'] == 'FAIL' }
  }
end

def sl(method, path, body)
  uri = URI("https://private.shopliveapi.com/v2/YOUR_ACCESS_KEY#{path}")
  req = Net::HTTP.const_get(method.capitalize).new(uri)
  req['Authorization'] = "Bearer #{ENV['SL_TOKEN']}"
  req['Content-Type'] = 'application/json'
  req.body = body.to_json
  res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(req) }
  data = JSON.parse(res.body.to_s) rescue nil   # the body may be empty or not JSON
  s = data.is_a?(Hash) ? data['_s'] : nil
  raise "#{res.code} #{res.body}" if res.code.to_i >= 400 || (s.is_a?(Numeric) && s < 0)  # error if HTTP ≥ 400 or _s < 0 (see Error responses)
  data
end

const crypto = require('crypto');
const express = require('express');
const app = express();

// Express: verify against the raw Buffer, before parsing
app.post('/webhooks/shoplive', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.get('X-SHOPLIVE-WEBHOOK-TIMESTAMP') || '';
  const sig = req.get('X-SHOPLIVE-WEBHOOK-SIGNATURE') || '';
  const expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET)   // secret string (UTF-8)
    .update(Buffer.concat([Buffer.from(ts + '.'), req.body])).digest('hex');
  const ok = sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);
  res.sendStatus(200);   // respond within about 1 second and hand the work to a queue
  const body = JSON.parse(req.body);   // body.campaignMeta.campaignKey
});

import hashlib, hmac, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/shoplive")
def shoplive_webhook():
    raw = request.get_data()   # raw bytes, before parsing
    ts = request.headers.get("X-SHOPLIVE-WEBHOOK-TIMESTAMP", "")
    sig = request.headers.get("X-SHOPLIVE-WEBHOOK-SIGNATURE", "")
    expected = hmac.new(os.environ["WEBHOOK_SECRET"].encode(),
                        ts.encode() + b"." + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        abort(401)
    return "", 200   # return 200 within about 1 second and hand the work to a queue

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;   // Java 17+

static boolean verify(String secret, String timestamp, byte[] rawBody, String signature) throws Exception {
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    mac.update((timestamp + ".").getBytes(StandardCharsets.UTF_8));
    String expected = HexFormat.of().formatHex(mac.doFinal(rawBody));
    return MessageDigest.isEqual(   // constant-time comparison
        expected.getBytes(StandardCharsets.UTF_8), signature.getBytes(StandardCharsets.UTF_8));
}