Authentication

To authenticate an API call successfully, pass your Consumer ID and digital signature in the API header for every API call you make.

First, register as a Marketplace Seller and get your Consumer ID and Private Key during onboarding or by logging in to the Seller Center. Then, use these keys and other headers to generate the digital signature.

Integration steps

1. Pick a simple call using the GET method, such as Get All Feed Statuses.

2. Generate a digital signature, either:

   • Generate the Digital Signature Using an Executable JAR file (Recommended)

   • Generate the Digital Signature Using Self-written Code
     We strongly recommend using the executable JAR file because it eliminates the vast majority of issues for authenticating calls.

3. Pass the header keys in the following table to authenticate your API call.

4. Make sure the call does not throw a 400 or 401 error. For more information, refer to Error Codes.

   • If a 400 HTTP status code is thrown, ensure all mandatory headers are passed. Also, validate all mandatory query or path parameters and the proper Accept HTTP header.

   • If a 401 HTTP status code is thrown, verify your generated digital signature to ensure the required parameters were passed to your authentication code.

If you have trouble connecting to the Walmart Developer Portal, refer to Troubleshooting.

Note: WM_CONSUMER.CHANNEL.TYPE is a mandatory header for V3 APIs. You can get the header value when you log in to Seller Center. For more details, refer to the article: API Settings.

Generate the digital signature using an executable JAR file (recommended)

To generate your digital signature using the executable JAR file, follow these steps:

1. Download Java 6.0 or greater. If it is not installed on your computer, go to: https://java.com/en/download.

2. Download the Digital Signature executable JAR file.

3. Use the following command to run the executable JAR file:

java -jar DigitalSignatureUtil-1.0.0.jar DigitalSignatureUtil {requestUrl} {consumerId} {privateKey} {requestMethod} {filePath}

The executable JAR file uses five parameters. See the following table:

Note: Your program must run this executable JAR file in the directory where the executable JAR file is located.

Running the executable JAR file returns the following two headers as the console output.

• WM_SEC.AUTH_SIGNATURE
• WM_SEC.TIMESTAMP

Note: Generate the signature and a timestamp for every API call, even if it is for the same API.

Generate the digital signature using self-written code

To get the digital signature using your own code, follow these steps:

1. Get the Consumer ID and your Base 64-encoded Private Key you generated in Seller Center.

2. Get the full URL you wish to call, including any path and query parameters.

3. Use the GET method to construct an input for the digital signature.

4. Use the structure listed below: The Consumer ID issued to you_ + “\n” + the URL of the API call you are making + “\n” + the request method of the API call you are making in all capitals + “\n” + the Unix Epoch timestamp now (in milliseconds since Jan 01 1970 UTC) + “\n”

5. Generate the byte array of the structured data listed in step 3 using the following steps:

   • Decode the byte array with Base-64.

   • Encode the resulting value using PKCS#8 to represent your Private Key. Libraries in various languages offer the ability to identify that the Private Key is in PKCS#8 format and not in other conflicting formats such as PKCS#1.

   • Use this byte representation of your private key to sign the data using SHA-256 with RSA.

   • Encode the generated digital signature using Base-64.

6. Use the generated digital signature and the timestamp to make your API call.

Troubleshooting

New users may have difficulties integrating with the platform for the first time. Typically, errors occur when incorrect headers are generated (such as the timestamp or authentication signature). To avoid errors, use the headers listed in the header samples displayed in the corresponding section.

Testing the API calls:

To accelerate development, you can use an online tool such as the Google Chrome Advanced REST Client App (ARCA), Postman, etc.

To test your API calls using the ARCA, follow the steps below:

1. Enter the URL: https://marketplace.walmartapis.com/v3/feeds

2. Select GET from the drop-down menu.

3. Configure the headers as listed in step 3 of the ‘Integration Steps’ section.

4. Select Send.

If basic API calls are successful from the ARCA, but not from your own code, the problem lies in your own code. If the calls fail from the ARCA, there is a problem with your headers.

Troubleshooting hints

• If the call from the ARCA succeeds, your headers are correct. But if your code fails, examine the headers.
• If the call from the ARCA fails and you are not using the executable JAR file, generate the headers using the executable JAR file and try again. If the call now succeeds, use the executable JAR file in your processes or adjust your code to correctly generate the headers.
• If the call from the ARCA fails and you are using the executable JAR file, generate a new set of credentials from Seller Center and retry with the new credentials (this ensures that the credentials are not obsolete or you have not reset your Private Key recently).
• If you are sure you have configured the ARCA correctly and are using the most current credentials but are still getting errors, contact Walmart Marketplace Support.