Magento has two important documents that outline how OAuth 1.0a authentication/authorization works (here and here). There also appears to be a Magento sponsored example of OAuth.

There are two important steps:

  1. Server to server POST for initial OAuth key exchange to the Callback URL. oauth_consumer_key, oauth_consumer_secret, oauth_verifier, and store_base_url are sent.
  2. User is redirected with a GET to the Identity Link URL. consumer_id and success_call_back are sent.

How in the world are #1 and #2 connected?

I don't see any common data and the example from Magento just uses a common session, which I can only assume is a horrible idea. Even more confusing is why consumer_id is sent with the user.

  • Maybe I should assume that this has never been used or there is no practical way to use it. I am considering using just the token based authentication instead. Commented Mar 29, 2016 at 15:39

2 Answers 2


This issue is resolved in the latest version of https://github.com/magento/magento2 (and will be available in 2.1.0 I suppose).

Now consumer_id is replaced with oauth_consumer_key in all requests. And thus oauth_consumer_key can be used as correlation ID. Here is a fork of the original example you mentioned. This fork is compatible with the latest version of Magento 2.


To me it looks like the example is wrong. Not sure how you found out it was a "Magento sponsored example" by the way.

The first step you mentionned is right, that is the activation step.

However the second step is wrong as there is no need to send the consumer_id (you can clearly see that this variable is not even used in the checklogin.php script).

On top of that, the use of this variable is never mentionned in the official documentation so I reckon that was mostly for testing purpose.

My advice is to stick to the official doc, scripts found online can sometimes be misleading.

  • Besides the poor example I found, this does not actually answer the question. These two requests are sent from separate web clients (first being from the server directly, second from the users' browser) and no "link" can be made between them as nothing common is shared. The official documents and examples offer no clue (that I have seen). Commented Mar 24, 2016 at 13:11
  • 1
    I guess this is why I feel like it is official. Commented Mar 24, 2016 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.