Shopping — entry 009 of 15
Mercadolibre
Mercado Libre exposes a large REST surface across its Latin American marketplace sites, covering listings, orders, ads, and shipping. Two read-only lookups work without a token: a category by ID, such as `/categories/MLA1051`, and `/sites/{site}/domain_discovery/search`. Everything else, including site lists, currencies, item listings and search, needs an OAuth2 access token from the authorization-code flow. The API itself carries no direct usage fee. Mercado Libre monetizes through marketplace and payment commissions instead.
Mercado Libre runs the largest online marketplace in Latin America. Most of the API needs an OAuth token tied to a seller account. Two read-only paths do not: category lookup and domain discovery. A live GET this run on /categories/MLA1051 returned real category data with no token sent.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/mercadolibre/"><img src="https://greatapis.com/badge/mercadolibre.svg" alt="Scored 57 on greatapis.com"></a>Auth quickstart
- Category lookup needs no key. A live
GET /categories/MLA1051this run returnedHTTP 200with the category name, item count, and child categories.GET /categories/MLA1051/attributesalso returnedHTTP 200, with the item attributes for that category. - Domain discovery needs no key either. A live
GET /sites/MLA/domain_discovery/search?q=celular&limit=1this run returnedHTTP 200with a matching category for the search term. - Most other paths need a token. Live calls this run to
/sites,/currencies,/sites/MLA,/sites/MLA/categories, and/items/<id>all returnedHTTP 403with{"code":"PA_UNAUTHORIZED_RESULT_FROM_POLICIES"}./sites/MLA/searchalso returnedHTTP 403, with{"message":"forbidden"}. - To get a token, create an application at Mercado Libre's developer site (the "My Applications" page) to get an APP ID and a secret key. Send the user to
https://auth.mercadolibre.com.ar/authorization?response_type=code&client_id=<APP_ID>&redirect_uri=<YOUR_URL>(swap.com.arfor the domain of your target country). After the user logs in and approves the app, Mercado Libre redirects to yourredirect_uriwith acodeparameter. - Exchange the code for a token with
POST /oauth/token, sent as form data:grant_type=authorization_code,client_id,client_secret,code, andredirect_uri. Per the vendor docs, the response looks like{"access_token":"APP_USR-...","token_type":"bearer","expires_in":10800,"refresh_token":"TG-..."}. Send the token back as aBearerheader on private calls.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Keyless category lookup
GEThttps://api.mercadolibre.com/categories/MLA1051
{"id":"MLA1051","name":"Celulares y Teléfonos","permalink":"https://www.mercadolibre.com.ar/c/celulares-y-telefonos","total_items_in_this_category":3355197,"path_from_root":[{"id":"MLA1051","name":"Celulares y Teléfonos"}],"children_categories":[{"id":"MLA3502","name":"Accesorios para Celulares","total_items_in_this_category":2439427},{"id":"MLA1055","name":"Celulares y Smartphones","total_items_in_this_category":129011},{"id":"MLA1058","name":"Handies y Radiofrecuencia","total_items_in_this_category":42603}]}MLA is the site prefix for Argentina. Mercado Libre runs a separate category tree per country: MLB1051 returns the same slot for Brazil, with names in Portuguese. A live GET /categories/MLA99999999 this run returned HTTP 404 with {"message":"Category not found: MLA99999999","error":"not_found"}, so an unknown ID fails loud instead of returning an empty body.
Developer reference
Gotchas & limits
- CORS is open on the keyless paths. A live
OPTIONSpreflight against/categories/MLA1051this run returnedHTTP 200withaccess-control-allow-originset to the request'sOriginheader. A plainGETwith noOriginheader returnedaccess-control-allow-origin: *. A browser page can call these two paths with no server proxy. - The 403 on gated paths comes from a policy layer, not a plain auth check. Live calls this run to
/sites,/currencies,/sites/MLA,/sites/MLA/categories, and/items/<id>all returned the same body shape:{"blocked_by":"PolicyAgent","code":"PA_UNAUTHORIZED_RESULT_FROM_POLICIES"}. Even reference data like the currency list needs a token now. - Keyless responses are cached. A live
/categories/MLA1051call this run returnedcache-control: max-age=600, so a category edit at Mercado Libre can take up to 10 minutes to show up in the API. - An access token lasts a few hours, not indefinitely. The vendor docs' own token response sets
expires_into10800(seconds). Save therefresh_tokenfrom that same response and use it to get a new access token before the old one expires; the vendor docs note each refresh token works only once.