Magento 2 custom authentication for API

Question

I want to implement custom ACL for my custom API. Can someone assist me how to achieve this.

Below is my webapi.xml file content:

<?xml version="1.0"?>
<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Webapi:etc/webapi.xsd">

    <route url="/V1/mymethod/show/:num1/:num2" method="GET">
        <service class="MyNamespace\CoreApi\Api\CoreApiInterface" method="show"/>
        <resources>
            <resource ref="self"/>
        </resources>
    </route>

</routes> 

Now instead of <resource ref="self"/> or <resource ref="anonymous"/>, is there any alternative available which is depends on my custom authentication rather than Magento.

The reason behind this is right now I'm build up custom API in which all of my frontend customer having a unique key say API key (We planned to develop this as well). And using this API key they will able to communicate with my custom API. And according to my requirements, I guess creating consumer key and secret through Magento admin (System > Extensions > Integrations) is not to be the advisable solution.

Is there any possibility to do so with Magento 2?

Answer 1

I'm a bit of confusion, but you can try this

create acl.xml and put some rules, then next, edit your webapi.xml to

something like this:

<route url="/V1/mymethod/show/:num1/:num2" method="GET">
    <service class="MyNamespace\CoreApi\Api\CoreApiInterface" method="show"/>
    <resources>
        <resource ref="[module name]::[acl rule id]"/>
    </resources>
</route>

Answer 2

Check the example in Magento

vendor/magento/module-sales/etc/webapi.xml

<route url="/V1/order/:orderId/ship" method="POST">
        <service class="Magento\Sales\Api\ShipOrderInterface" method="execute"/>
        <resources>
            <resource ref="Magento_Sales::sales" />
        </resources>
</route>

Similarly you can use your own module ACL