Skip to main content
Semji connects to Magento through the REST Admin API, authenticating every request with an Integration access token sent as a Bearer credential. Once connected, Semji’s AI agents can work on the four kinds of content a Magento store carries: CMS pages, CMS blocks, product content (descriptions and SEO fields), and category content (the SEO text of category pages). Compatible with Magento 2.4 — Magento Open Source and Adobe Commerce, self-hosted or on Adobe Commerce on cloud infrastructure (PaaS).

​
Prerequisites

  • Magento 2.4.x, Open Source or Adobe Commerce, served over HTTPS with a certificate from a publicly-trusted CA, and reachable from the public internet. Private hostnames, self-signed certificates, and plain HTTP are rejected.
  • A dedicated Integration created for Semji — never a personal admin user’s token. See Step 1.
  • The Integration’s API permissions (Resource Access) granted as listed in API permissions for the Integration.
  • On Magento 2.4.4 and above: the setting “Allow OAuth Access Tokens to be used as standalone Bearer tokens” enabled — see Step 1. Without it, every request returns 401 even with a valid token.
  • If a firewall, WAF, or anti-bot protection (Fastly, Cloudflare, Akamai, …) sits in front of your store, it must allow Semji’s IP addresses on the REST API path — see Firewalls and IP allowlisting.
  • You are a workspace owner in Semji. The connection is shared with the whole workspace.
Availability of the Magento integration depends on your Semji plan. If the Connect button opens an upgrade dialog instead of the connection form, contact your account manager.
Adobe Commerce as a Cloud Service (the newer SaaS offering that authenticates through Adobe IMS OAuth) is not supported. The connector authenticates exclusively with an Integration access token used as a Bearer credential.

​
Step 1 — Prepare your Magento store

1

Create a dedicated Integration

In the Magento admin, go to System → Extensions → Integrations and click Add New Integration. Give it a recognizable name (e.g. Semji).Do not reuse a personal admin account’s token: an Integration can be scoped to exactly the permissions Semji needs, it survives admin account changes or offboarding, and it can be revoked independently without affecting any human user.
2

Grant the API permissions

On the Integration’s API tab, set Resource Access to Custom and tick every checkbox listed in API permissions for the Integration.Setting Resource Access to All also works if your security policy allows it — you can narrow it down later.
3

Activate and copy the Access Token

Save, then click Activate on the Integration’s row and approve the permission summary. Magento displays four credentials — Semji only needs the Access Token. Copy it.
4

On Magento 2.4.4+ — allow tokens as standalone Bearer tokens

Since Magento 2.4.4, the REST Admin API rejects Integration access tokens used as bare Bearer tokens unless the store explicitly opts in. Enable:Stores → Configuration → Services → OAuth → Consumer Settings → “Allow OAuth Access Tokens to be used as standalone Bearer tokens” → Yesor via CLI:
A cache flush may be needed for the change to take effect.

​
API permissions for the Integration

On the Integration’s API tab, with Resource Access set to Custom, tick the following checkboxes:
The product-attributes checkbox lives under Stores, not under Catalog. Stores → Attributes → Product and Catalog → Inventory → Products are two unrelated branches of the permission tree despite the similar names. Ticking the Catalog one without the Stores one breaks content-model discovery for products.
“Save Page” is a separate permission from “Pages”. Reading pages and writing pages are distinct ACL resources in Magento. Ticking the Pages parent checkbox selects its children automatically, but if you compose the selection checkbox by checkbox, do not skip Save Page — reads will work and every create or update will fail with a 401.
If the permissions look right but requests still return 401, re-open the Integration, re-select the resources, and save again. A partially saved custom selection can leave the permission state inconsistent, and a clean re-save repairs it.

​
Step 2 — Connect from Semji

1

Open the CMS integrations

In Semji, go to Settings → Integrations, open the CMS tab, and click Connect on the Magento row.
2

Enter your store's credentials

Fill in the two fields:
  • Store URL — the canonical HTTPS base URL of your store, e.g. https://your-store.com. Semji does not follow redirects, so use the exact URL your store resolves to (www vs non-www matters).
  • Integration access token — the Access Token copied in Step 1.
Click Next. Semji tests the connection live by calling GET /rest/all/V1/store/websites on your store with the token.
3

Pick the Magento tools

Choose what AI agents can do on your store. Every tool is enabled by default; you can disable any of them:
  • List store views — read the store views and their base URLs.
  • Describe content model — inspect the writable fields of pages, blocks, products and categories.
  • List contents — browse and search CMS pages, blocks, products and categories.
  • Read contents — retrieve a page, block, product or category and its content.
  • Create & update content — create and update CMS pages and blocks, update product and category content.
  • Delete content — delete CMS pages and blocks.
4

Activate

Click Activate. The Magento row now shows as connected.

​
What Semji can do once connected

A few guarantees built into the connector:
  • Products and categories are never created or deleted — Semji only updates the content fields of entities that already exist.
  • Product and category edits go live immediately (Magento has no draft state for them), so agents show the exact field-by-field change and wait for your explicit validation before writing.
  • Page and block updates are lossless. Magento’s save endpoints replace the whole entity, so Semji reads the current entity, merges only the fields the agent changed, and writes the full payload back — anything the agent did not touch is preserved.
  • Deletion is never exposed to publishing agents. Even with the Delete tool enabled, Semji’s CMS Publisher agent is deliberately not given access to it.

​
Store views

Magento content is per store view: the same page, product, or category can carry different content on each store view.
  • Agents read the store views first and target an explicit store view when you name a specific store, language, or locale.
  • On multi-store installations, agents verify that the entry they are about to touch belongs to your workspace’s website before writing, and refuse to modify content that belongs to another site hosted on the same Magento instance.
  • Product and category writes never target Magento’s all scope — a known Magento issue can silently reassign website associations on writes scoped to all.

​
Manage or disconnect

From Settings → Integrations → CMS, the Magento row offers:
  • Manage tools — enable or disable each tool individually.
  • Disconnect — remove the integration for the whole workspace.

​
Firewalls and IP allowlisting

Semji’s servers call your store’s REST Admin API directly. If your store sits behind Fastly, Cloudflare, or another WAF, you must allow those calls or the connection will fail. Semji’s servers reach the internet through a fixed set of outbound IP addresses. If a firewall, WAF, or anti-bot protection (Cloudflare, Akamai, Sucuri, …) sits in front of your site, it can block Semji’s requests — typically with a 403 Forbidden — before they ever reach your CMS, even when your credentials are correct. Allow the following Semji IP addresses:
Allow these addresses on the REST API path (/rest/*). On stores where the edge layer rate-limits or challenges API traffic, exempt Semji’s addresses from those rules as well.
A WAF answering with an HTML challenge or a 403 on /rest/* makes Semji report a security-layer error even though your token and permissions are correct. If the credentials look right, check the firewall first.

​
Troubleshooting

Magento returns the same 401 status for three different problems — check them in order:
  1. The token value is wrong — re-copy the Access Token from the Integration (System → Extensions → Integrations). Note that re-creating or re-authorizing an Integration generates a new token.
  2. On Magento 2.4.4+, the Bearer setting is off — enable “Allow OAuth Access Tokens to be used as standalone Bearer tokens” (see Step 1) and flush the cache.
  3. The Integration lacks API permissions — Magento answers 401 with “The consumer isn’t authorized to access %resources” naming the missing ACL resource. Grant every checkbox in API permissions for the Integration, save again, and retry.
A quick way to tell cases 1–2 apart from case 3: if some REST endpoints respond with the token while others return 401, the token and the Bearer setting are fine — the remaining 401s are missing permissions.
GET /rest/all/V1/store/websites returned a 404. Frequent causes:
  • The Store URL is wrong or points to a specific store-view path. Enter the bare base URL of the store.
  • The URL redirects. Semji follows no redirects: if https://example.com redirects to https://www.example.com, enter the www URL.
  • A reverse proxy in front of Magento strips or blocks the /rest path.
The response came from a WAF or anti-bot layer (a 403, or a non-JSON challenge page) instead of Magento. Allow Semji’s IP addresses on /rest/* — see Firewalls and IP allowlisting.
  • DNS failure or host down.
  • The store is too slow — responses must arrive within 10 seconds.
  • The URL points to a private or reserved address — localhost and private-network hosts are rejected; the store must be publicly reachable.
The token authenticates, but the Integration lacks the ACL resource for that specific action — for example, pages can be read but not saved (missing Save Page), or products cannot be listed (missing Catalog → Inventory → Products). Grant the corresponding checkbox from API permissions for the Integration and save the Integration again.
That is Magento’s behavior, not a bug: products and categories have no draft state, so every write is live on the storefront. Semji’s agents show the exact diff and require your explicit validation before each product or category write for this reason. CMS pages and blocks, in contrast, are created as drafts.
  • “Please enter a valid URL.” — the value does not parse as a URL.
  • “The store URL must start with https://.” — HTTP stores cannot be connected.
  • “The store URL points to a private or reserved address, which is not allowed.” — the store must be publicly reachable.