How to use token base Rest API?

Question

I have created custom module and also implemented API in that but I want to know other two ways Auth base and Token base access.
My webapi.xml file:-

<?xml version="1.0"?>
<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"      xsi:noNamespaceSchemaLocation="../../../../../app/code/Magento/Webapi/etc/webapi.xsd">
<route url="/V1/brand/getList" method="GET">
    <service class="Ktpl\BrandManagement\Api\BrandRepositoryInterface" method="getList"/>
    <resources>
        <resource ref="anonymous"/>
    </resources>
</route>

I am able to get all the brand list but want to make this request more safer using auth and token base request.

Answer 1

In magento web-API when you pass user name and password then it genrates token for that specific customer (Which is only valid for 1 hour - configurable from admin)

http://magento.host/index.php/rest/V1/integration/customer/[email protected]&password=test@123

webapi.xml code

<route url="/V1/customers/me" method="GET">
    <service class="Magento\Customer\Api\CustomerRepositoryInterface" method="getById"/>
    <resources>
        <resource ref="self"/>
    </resources>
    <data>
        <parameter name="customerId" force="true">%customer_id%</parameter>
    </data>
</route>

which returns token.

After genrating token, when we pass that token in header.

Authorization :: Bearer <Token Value>

http://magento.host/index.php/rest/V1/customers/me

Which returns customer detailes.

The above case i explained is working fine for webAPI in magento2 which i tested in POSTMAN.

Answer 2

You need to change this line:

<resource ref="anonymous"/>

Don't know your module, but you can create an ACL for this module and use it. Or you can just use another ACLs from other modules.

Search for the acl.xml inside etc folder.

The syntax is:

<resource ref="<vendorName>_<moduleName>::<keyACL>"/>

Well, all of this are defined on the acl.xml.