EcomSource API Documentation
Everything you need to integrate EcomSource product data into your application: how authentication works, the endpoint, working request examples, what responses contain, and how limits behave. The sandbox key is free, 10 calls a day against the full index, so you can run every example on this page before paying anything.
TL;DR
- One endpoint: POST /api/v1/search/product with any identifier type.
- Auth is two headers: X-Access-Key and X-Secret-Key from your dashboard.
- Responses are JSON with identifiers, catalog fields, media, and Amazon intelligence.
- Misses return a structured not-found, and rate limits meter monthly on paid plans.
Quickstart: your first call
- Create a free account and copy your access key and secret key from the dashboard.
- Send the request below with any identifier you have on hand.
- Read the JSON. That shape is consistent across every identifier type.
identifierType accepts upc, ean, gtin, isbn, and asin. Node.js, Axios, and Python versions of the same call are shown on the pricing page code panel and in your dashboard after signup.
Authentication
Every request carries two headers: X-Access-Key identifies your account, X-Secret-Key proves it. Treat the secret like a password: server-side only, never in client code or repositories, rotated from the dashboard if exposed. Our API authentication guide covers key handling patterns that pass security review.
The response, in brief
| Block | Contents |
|---|---|
| identifiers | upc, ean, gtin, isbn, asin, cross-referenced for the matched product |
| product | title, brand, manufacturer, model, category |
| media | image links |
| logistics | dimensions and weight where available, code for nulls |
| amazon | variation family, buy box price, sales rank, on plans that include it |
| status | matched, ambiguous with candidates, or not_found |
Full field semantics for what each block returns live on the product data API page, this page stays focused on the mechanics.
Identifier cheatsheet
| identifierType | Send | Notes |
|---|---|---|
| upc | 12 digits | Leading zeros matter, send as a string |
| ean | 13 digits | A US code abroad is usually 0 plus the UPC |
| gtin | 8, 12, 13, or 14 digits | Auto-detected by length |
| isbn | 10 or 13 digits | Dashes optional |
| asin | 10 characters | Capitals, usually starting B0 |
Errors and misses
A product that is not in the index is not an HTTP error: you get status not_found in a normal 200 response. Route those to a name-search fallback or human review.
- HTTP 401 means a key problem, check both headers.
- HTTP 429 means you hit a limit, back off and retry after the window. Batching and backoff patterns are in our rate limiting guide.
- Validation failures, like a 13-digit code sent as identifierType upc, return a clear message naming the field.
Limits and plans
The sandbox allows 10 calls a day, forever, with full responses. Paid plans meter monthly: 10,000 calls at $49, 50,000 at $149 with bulk CSV and JSON exports plus webhooks, and custom enterprise volumes with database snapshots (pricing page, August 2026). Bulk one-off jobs can skip code entirely with the bulk barcode lookup.
Build ideas and references
- Product database architecture for ecommerce apps: our product database API guide.
- Grounding AI agents in identifier lookups: product identifier APIs for AI agents.
- Deciding between scraping and an API honestly: web scraping vs API.
Frequently asked questions
How do I get an API key?
Create a free account and both keys appear in your dashboard. The sandbox tier is free permanently with 10 calls a day and needs no card.
Which identifiers can I send?
upc, ean, gtin, isbn, and asin, all through the same endpoint via the identifierType field, plus name search when you have no code.
What happens on a miss?
A structured not_found status in a normal response, never an invented record. Build a fallback to name search or review for those rows.
What are the rate limits?
Sandbox is 10 calls a day. Paid plans meter monthly, 10,000 to 50,000 calls on standard tiers, so there is no daily cliff mid-batch (August 2026).
Do you have SDKs?
Requests are plain REST with JSON, so any HTTP client works. Copy-paste examples exist for cURL, Node.js, Axios, and Python, and most teams wrap the one endpoint in a few lines.
Get building
Create a free sandbox key and run the quickstart below. You will have real product JSON inside five minutes.
Create a free sandbox key