What is it?

How does it work?

• set key name
• generate key code
• enable or disable it
• set IP addrees from which you can use this key
• see sessions of this key

Autorisation first 

$apiKey = 'dzL3oaoqLHXCT3ZEyS4u3in3urBrUAD1kLagTFihrKN8D1XUQewGsxSOSWzibnWs4F414PPxmMuDD';
 
$curl = curl_init( 'http : // localhost/opencart/2101/index.php?route=api/login/' );
 
$post = array (
  'key' => $apiKey
);
 
curl_setopt_array( $curl, array(
  CURLOPT_RETURNTRANSFER=> TRUE,
  CURLOPT_POSTFIELDS      => $post
) );
 
$response = json_decode(curl_exec( $curl ));
curl_close($curl);
if (isset($response->token)) {
  $token = $response->token;
} else {
  // errors handler
  // var_dump($response)
}

$curl = curl_init( 'http :// localhost/opencart/2101/index.php?route=api/cart/add/&token=' . $token );
 
$post = array (
  'product_id' => 41
);
 
curl_setopt_array( $curl, array(
  CURLOPT_RETURNTRANSFER=> TRUE,
  CURLOPT_POSTFIELDS      => $post
) );
 
$response = json_decode(curl_exec( $curl ));
curl_close($curl);

What can we do with OpenCart API?

Unfortunately, not to much. For now, we can only work with a cart. 
We can:

• add products to the cart
• get products from the cart
• change currency
• add coupons
• add payment and delivery methods
• create an order
• etc.

A bit of criticism:

1. Very few API methods. For now, you can only "buy" some products programmatically. And that is all what you get from the box.
2. Weak API. You can not set specific key to the specific API method or methods, there are no requests log with information about requests (IP, POST, GET data, response, etc.)
3. IP for the API key is mandatory. You can not create key which will work for any IP
4. Uncomfortable errors statuses which are returned by API. Sometimes it is string , sometimes it is object "error" with value "key", sometimes it is "warning", etc. It is difficult to handle all of these statuses.