Connect your Miva Merchant store to EcomCentral using HMAC-SHA256 signed API requests for secure authentication.
Miva Merchant is a mature US-based e-commerce platform widely used by enterprise retailers. Founded in 1997, it powers thousands of mid-to-large online stores in North America and is known for its deep customization capabilities and robust built-in functionality. Miva exposes all store data through a proprietary JSON API that uses HMAC-SHA256 request signing for authentication, ensuring every call is cryptographically verified.
json.mvc endpoint (e.g. https://store.com/mm5/json.mvc). API access must
be enabled in Admin and an API token must be created before connecting.
https://your-store.com/mm5/json.mvc. The mm5 path segment may vary per installation.PS or MYSTORE)https://your-store.com/mm5/json.mvc| Key | Required | Description | Example |
|---|---|---|---|
base_url |
Required | Full JSON API URL including the json.mvc path |
https://store.com/mm5/json.mvc |
store_code |
Required | Store Code from Settings → Store Information | MYSTORE |
access_token |
Required | API access token from User Management → API Tokens | •••••••••••••••• |
signing_key |
Optional | HMAC-SHA256 signing key (base64-encoded, copied exactly from Miva Admin). Leave blank to use unsigned MIVA <token> authentication. |
YWJjZGVmZ2g= |
baseUrl or url for the API URL;
storeCode or store for the store code;
accessToken or token for the access token;
signingKey or hmac_key for the signing key.
signing_key is left blank, EcomCentral
uses MIVA <token> authentication (no HMAC). This works when the API token is
configured without a signing key in Miva Admin.
All requests are POST to the json.mvc endpoint with a JSON body containing
Store_Code, Miva_Request_Timestamp, Function, and
function-specific parameters.
| Operation | Miva Function | Key Parameters |
|---|---|---|
| Test connection | OrderList_Load_Query | Count=1, Offset=0 |
| List orders | OrderList_Load_Query | Count, Offset, Sort=-orderdate |
| Order detail | Order_Load | Order_ID |
| List products | ProductList_Load_Query | Count, Offset |
| Product detail | Product_Load_Code | Product_Code (the SKU) |
| Create shipment | OrderItemList_CreateShipment | Order_ID, Line_IDs |
| Add tracking | OrderShipmentList_Update | Shipment_Updates[].{shpmnt_id, tracknum, tracktype, mark_shipped} |
| Update stock | InventoryProductSettings_Update | Product_SKU, CurrentStock |
{ success:1, data:{ total_count:N, start_offset:N, data:[...] } }.
Single-item responses return { success:1, data:{ data:{...} } }.
Application-level errors return { success:0, error_code:"...", error_message:"..." }.
Miva uses numeric status codes for orders. EcomCentral maps these to labels and displays them with colour-coded badges.
| Code | Label | Badge colour |
|---|---|---|
0 |
Pending | Blue |
100 |
Processing | Blue |
200 |
Shipped | Green |
201 |
Partially Shipped | Amber |
300 |
Cancelled | Red |
400 |
Backordered | Amber |
500 |
RMA Issued | Amber |
600 |
Returned | Red |
| Feature | Supported | Notes |
|---|---|---|
| View orders (paginated) | ✅ | Order ID, date (unix timestamp), status, total |
| View order detail | ✅ | Billing & shipping addresses, email, phone, line items, total, existing shipments/tracking |
| Add tracking number | ✅ | Two-step: OrderItemList_CreateShipment creates the shipment, then OrderShipmentList_Update attaches tracking and marks it shipped |
| View products (paginated) | ✅ | SKU, name, price, inventory quantity |
| View product detail | ✅ | Full product via Product_Load_Code — description (HTML stripped), weight, inventory managed flag |
| Update stock quantity | ✅ | InventoryProductSettings_Update with absolute CurrentStock value, by SKU |
| Test connection | ✅ | OrderList_Load_Query with Count=1 — success confirms host, credentials, and store code are valid |
The signing key must be copied exactly as displayed in Miva Admin — it is already base64-encoded. Do not decode it, trim it, or add extra characters. EcomCentral decodes it internally before computing the HMAC. If you copied it correctly and still get errors, try regenerating the token.
The store code is case-sensitive. Verify it under Settings → Store Information
in Miva Admin. A wrong store code typically returns success:0 with an error about
an invalid store.
The API token may not have permission to call a specific function. In Miva Admin, check the token's permission groups or allowed functions and ensure the operations you need (OrderList_Load_Query, ProductList_Load_Query, etc.) are permitted.
Miva returns HTTP 200 with { "success": 0, "error_code": "...", "error_message": "..." }
for application-level failures. Common causes: invalid function name, missing required parameter,
or an order/product that does not exist. The error message returned by Miva will be shown in
EcomCentral's error banner.
EcomCentral requires a valid SSL certificate on the store. Self-signed certificates are rejected. Use a certificate from a trusted CA (e.g. Let's Encrypt) or contact your hosting provider.
curl -X POST https://your-store.com/mm5/json.mvc \
-H "Content-Type: application/json" \
-H "X-Miva-API-Authorization: MIVA your-token-here" \
-d '{"Store_Code":"YOURCODE","Miva_Request_Timestamp":1,"Function":"OrderList_Load_Query","Count":1}'
A { "success": 1, ... } response confirms the endpoint and token are correct.