The admin token from chapter 3 was perfect for a QUICK test – for our app itself, let's now set up the cleaner path: a dedicated Integration in the Magento admin panel.

Why an integration instead of admin login?

• Not tied to a person: if an employee's admin password changes, the integration stays untouched.
• Restrictable permissions: an integration can be scoped to EXACTLY the resources it needs (here: catalog/products) – instead of having full admin access.
• Traceable: a dedicated name in the integration log shows WHICH application is accessing the API, instead of "some admin login".

Creating an integration in the admin panel

1. Open the Magento admin → System → the "Extensions" section → Integrations.
2. Click Add New Integration.
3. Give it a descriptive name, e.g. magento-produkt-explorer, and enter your current admin password to confirm (Magento requires this for security on EVERY new integration).
4. In the API tab, select the required resources – "Catalog" (reading products) is enough for this project. The narrower the permissions, the safer.
5. Click Save, then click Activate on your new integration in the integrations list.
6. Magento shows a confirmation dialog with the permissions to be granted – click Allow.

After activation, Magento displays four values ONE TIME ONLY (Consumer Key, Consumer Secret, Access Token, Access Token Secret) – for our purposes, only the Access Token matters, it works EXACTLY like chapter 3's admin token as a bearer token in the Authorization header.

Testing the integration token

TOKEN="YOUR_INTEGRATION_ACCESS_TOKEN"

curl -s https://YOUR-SHOP.com/rest/V1/products?searchCriteria%5BpageSize%5D=2 \
  -H "Authorization: Bearer $TOKEN"

Does this call work the same as in chapter 3 with the admin token? Then you now have a production-ready access, INDEPENDENT of your personal admin account – exactly what our app actually uses starting in chapter 7.

Admin token vs. integration token: the balance sheet