Muvexa
Sign up

Amazon SP-API and Daraz proxy documentation

Authorize a store, test requests in the online console, or call the same platform endpoint from your backend. Free includes 100 calls per account per day.

Who this documentation is for

These docs are written for technical teams integrating Amazon SP-API or Daraz Open Platform through Muvexa.

SaaS, ERP, OMS, WMS and internal engineering teams that need marketplace API access.
Agencies and integrators managing API access for multiple authorized stores.
Developers who want to test first in the browser, then integrate through a server-to-server API.

Quickstart

Authorize a store, test requests in the online console, or call the same platform endpoint from your backend. Free includes 100 calls per account per day.

1

Register and authorize a store

Create a Muvexa account, open the console, and generate a store authorization link. After authorization, Muvexa issues a store-scoped API Key.

2

Test online in the API Console

For testing, use the online API Console to send marketplace requests and inspect status, latency and response metadata.

http
POST https://openapi.muvexa.co/v1/amazon/execute
Content-Type: application/json
X-Api-Key: <your-api-key>
X-Timestamp: 1723795200000
X-Nonce: 7b1f2d0c-5b52-4c74-a615-0d7e3cce8e9c
X-Signature: <hmac-sha256-hex>

{
  "method": "GET",
  "path": "/orders/v0/orders",
  "queryParams": {
    "MarketplaceIds": "ATVPDKIKX0DER",
    "CreatedAfter": "2026-01-01T00:00:00Z"
  }
}
3

Connect your backend

Use the store API Key from your backend to call the platform endpoint. This is available on Free and Pro; the plan determines the call quota.

Free and Pro API quotas

Both plans support online console testing and server-to-server API integration. Choose Pro when you need unlimited calls.

Free

For testing and lightweight integrations with a daily shared quota.

Register and authorize a real store.
Use the online console or call the API from your backend.
100 total calls per account per day across both methods.

Pro

For production systems that need unrestricted request volume.

Use the store API Key from your server.
Send requests to the Muvexa proxy endpoint.
Muvexa handles managed developer access and signing.

Platform endpoints

Each marketplace has one stable Muvexa endpoint. The request contract stays the same across platforms.

http
Amazon
POST https://openapi.muvexa.co/v1/amazon/execute

Daraz
POST https://openapi.muvexa.co/v1/daraz/execute
Use the Amazon endpoint for Amazon SP-API paths and the Daraz endpoint for Daraz Open Platform paths.
The v1 segment versions the Muvexa request contract independently from marketplace API versions.
A store API Key can call only the platform it was issued for; a mismatch returns PLATFORM_MISMATCH.

Request signature

Every server-to-server request must be signed with the API Secret shown in the console. X-Api-Key is sent in plaintext; API Secret is never sent.

X-Api-Key identifies the store authorization and token mapping.
X-Timestamp is the current Unix timestamp in milliseconds. Requests outside the allowed time window are rejected.
X-Nonce must be unique within the nonce window to prevent replay.
X-Signature is HMAC-SHA256 hex of the canonical string, using API Secret as the key.
text
HTTP_METHOD + "\n" +
REQUEST_PATH + "\n" +
QUERY_STRING + "\n" +
SHA256_HEX(raw_body) + "\n" +
X_TIMESTAMP + "\n" +
X_NONCE
javascript
import crypto from "node:crypto";

const apiKey = "gk_live_xxx";
const apiSecret = "your-api-secret";
const url = "https://openapi.muvexa.co/amazon/execute";
const body = JSON.stringify({
  siteCode: "US",
  method: "GET",
  path: "/finances/v0/financialEvents",
  queryParams: {}
});

const timestamp = String(Date.now());
const nonce = crypto.randomUUID();
const { pathname, searchParams } = new URL(url);
const queryString = searchParams.toString();
const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
const stringToSign = [
  "POST",
  pathname,
  queryString,
  bodyHash,
  timestamp,
  nonce
].join("\n");

const signature = crypto
  .createHmac("sha256", apiSecret)
  .update(stringToSign)
  .digest("hex");

const res = await fetch(url, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Api-Key": apiKey,
    "X-Timestamp": timestamp,
    "X-Nonce": nonce,
    "X-Signature": signature
  },
  body
});

console.log(res.status, await res.text());

API integration format

API integration is available on Free and Pro. Send X-Api-Key and signature headers, then send the target marketplace request to its platform endpoint.

method: HTTP method of the original marketplace endpoint, such as GET, POST, PUT or DELETE.
path: original platform API path, for example /orders/v0/orders.
queryParams: query parameters sent to the marketplace endpoint.
body: request body for POST/PUT endpoints. Use null for GET requests.
json
{
  "method": "GET",
  "path": "/orders/v0/orders",
  "queryParams": {
    "MarketplaceIds": "ATVPDKIKX0DER",
    "CreatedAfter": "2026-01-01T00:00:00Z"
  },
  "body": null
}
json
{
  "ok": true,
  "platform": "amazon",
  "status": 200,
  "latencyMs": 142,
  "requestId": "req_01J8Z6Y6H6M4Y2N7S8",
  "data": {
    "payload": {
      "Orders": [
        {
          "AmazonOrderId": "902-0000000-0000000",
          "OrderStatus": "Shipped"
        }
      ]
    }
  }
}
json
{
  "ok": false,
  "platform": "amazon",
  "status": 403,
  "requestId": "req_01J8Z6Y6H6M4Y2N7S9",
  "error": {
    "code": "AUTHORIZATION_FAILED",
    "message": "The store is not authorized for this operation.",
    "diagnostic": {
      "cause": "Missing marketplace permission",
      "fix": "Re-authorize the store with the required role."
    }
  }
}

Quota and errors

Free tier: 100 total calls per account per day across the online console and backend API, reset at UTC midnight.
Pro tier: unlimited calls across the online console and backend API through the same platform endpoints.
403/authorization errors include a _diagnostic field with cause and fix suggestion.
Other errors retain the target marketplace's original status code and response body.

Privacy & Data

This platform does not collect, store or expose buyer personally identifiable information (PII).

Call history records metadata only (method, path, status code, latency) — never request or response bodies.
Buyer-data restricted endpoints are outside the documented public proxy surface.
Store refresh tokens are encrypted at rest; the backend keeps only authorization mappings and call metrics — no PII.