I'm hanging on this issues for nearly a week and cannot find any sollution. I'm trying to send a REST request to my new Magento2 store. It worked allready, but then the oauth/token forced authentication was activated, now I can't beak through to the backend. I tried it with the scribe framework v1.8.0, here's my attempt:

public class MagentoApi extends DefaultApi10a {
private static final String BASE_URL = "http://myshopurl.de/";
private static final String AUTHORIZE_URL = "http://myshopurl.de/oauth/oauth_authorize?oauth_token=";
private static final String REQUEST_TOKEN_ENDPOINT = "http://myshopurl.de/oauth/token/request";
private static final String ACCESS_TOKEN_ENDPOINT = "http://myshopurl.de/oauth/token/access";

public String getAccessTokenEndpoint() {

public String getRequestTokenEndpoint() {

public String getAuthorizationUrl(OAuth1RequestToken requestToken) {
    return String.format(AUTHORIZE_URL, requestToken.getToken());
public static MagentoApi instance() {
    return MagentoApi.InstanceHolder.INSTANCE;

private static class InstanceHolder {
    private static final MagentoApi INSTANCE = new MagentoApi();

    private InstanceHolder() {

And here my testclient:

public class AuthTest {

    private static final String CONSUMER_KEY  = "MYCONSUMERKEYHERE";
    private static final String CONSUMER_SECRET  = "MYSECRETKEYHERE";

    public static void main(String[] args) throws IOException {
        OAuth10aService service = new ServiceBuilder()
    final OAuth1RequestToken requestToken = service.getRequestToken();
    final String oauthVerifier = in.nextLine();
    final OAuth1AccessToken accessToken = service.getAccessToken(requestToken, oauthVerifier);
    final OAuthRequest request = new OAuthRequest(Verb.GET, The_Magento_Get_Categories_REST_URL, service);
    service.signRequest(accessToken, request);
    final Response response = request.send();

The result is appearing in this line: final OAuth1RequestToken requestToken = service.getRequestToken();

this is the sysout:

Fetching the Request Token...
obtaining request token from http://myshopurl.de/oauth/token/request
setting oauth_callback to oob
generating signature...
using base64 encoder: CommonsCodec
base string is: POST&http%3A%2F%2Fmyshopurl.de%2Foauth%2Ftoken%2Frequest&oauth_callback%3Doob%26oauth_consumer_key%thekey%26oauth_nonce%3D3285773414%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1467397682%26oauth_version%3D1.0
signature is: u4h6pVZw6tU8aj0NdFljBSB3h9o=
appended additional OAuth parameters: { oauth_nonce -> 3285773414 , oauth_signature -> u4h6pVZw6tU8aj0NdFljBSB3h9o= , oauth_callback -> oob , oauth_consumer_key -> thekey, oauth_timestamp -> 1467397682 , oauth_signature_method -> HMAC-SHA1 , oauth_version -> 1.0 }
using Http Header signature
sending request...
response status code: 401
response body: oauth_problem=Consumer+key+has+expired

I'm really begging for help.

Otherwise, is there a possibility to deactivate the authentication via REST at all?

Thank you in advance!

PS: The integration is activated in the backend. I also tried reauthorizing several times. Integration Authorized

1 Answer 1


According to the error message your consumer key has expired.

You need to access your backend under System > Extensions > Integration choose your integration and click Activate

The full documentation is available here: http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-oauth.html

  • Hello, maybe I needed to say that the integration is activated, I attached a screenshot
    – Java_Waldi
    Jul 1, 2016 at 18:52
  • @Java_Waldi yes but the expiration is 300 seconds you may need to re activate the integration Jul 1, 2016 at 20:53
  • 1
    As I allready mentioned above, I allready tried reauthorizing several times. I Also tried setting the expiration time to 0 or max value. Result was always the same. The documentation is not helpful at all because there is no java exaample given.
    – Java_Waldi
    Jul 2, 2016 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.