I'm trying to use REST API access. I followed all the guides found to enable the api and oauth functionalities. I'm using this code to retrieve the access and then make the request


  class Vashi_Restapi_TestController extends Mage_Core_Controller_Front_Action {

    public function indexAction() {

    //Basic parameters that need to be provided for oAuth authentication
    //on Magento

         $params = array(
            'siteUrl' => Mage::getBaseUrl().'/oauth',
            'requestTokenUrl' => Mage::getBaseUrl().'/initiate',
            'accessTokenUrl' => Mage::getBaseUrl().'/oauth/token',

            'consumerKey' => '3157bsm22p5q80t7zcujfi9uzxafefic',//Consumer key registered in server administration
            'consumerSecret' => 'zo22y43t1d63okihubfgkg39rdg3pjvl',//Consumer secret registered in server administration
            'callbackUrl' => Mage::getBaseUrl().'/restapi/test/callback',//Url of callback action below

        // Initiate oAuth consumer with above parameters
        $consumer = new Zend_Oauth_Consumer($params);
        // Get request token
        $requestToken = $consumer->getRequestToken();

        // Get session
        $session = Mage::getSingleton('core/session');
        // Save serialized request token object in session for later use
        // Redirect to authorize URL


    public function callbackAction() {

        //oAuth parameters
        $params = array(
            'siteUrl' => Mage::getBaseUrl().'/oauth',
            'requestTokenUrl' => Mage::getBaseUrl().'/initiate',
            'accessTokenUrl' => Mage::getBaseUrl().'/oauth/token',
            'consumerKey' => '3157bsm22p5q80t7zcujfi9uzxafefic',
            'consumerSecret' => 'zo22y43t1d63okihubfgkg39rdg3pjvl'

        // Get session
        $session = Mage::getSingleton('core/session');
        // Read and unserialize request token from session
        $requestToken = unserialize($session->getRequestToken());
        // Initiate oAuth consumer
        $consumer = new Zend_Oauth_Consumer($params);
        // Using oAuth parameters and request Token we got, get access token
        $acessToken = $consumer->getAccessToken($_GET, $requestToken);
        // Get HTTP client from access token object
        $restClient = $acessToken->getHttpClient($params);
        // Set REST resource URL
        // In Magento it is neccesary to set json or xml headers in order to work
        $restClient->setHeaders('Accept', 'application/json');
        // Get method
        //Make REST request
        $response = $restClient->request();
        // Here we can see that response body contains json list of products


I tried also the admin, customers and guest access but the result is always:

An error occurred. Your authorization request is invalid.

It seems the oauth token is not being generated as the url I can see is:


Really struggling with it, any advice? thanks

UPDATE: Tryied the apache configuration proposed but it still not working.

I was able to obtain the token using ruby oauth client, still not working via PHP

oauth \
  --verbose \
   --query-string \
   --consumer-key 3157bsm22p5q80t7zcujfi9uzxafefic \
   --consumer-secret zo22y43t1d63okihubfgkg39rdg3pjvl \
   --access-token-url http://magento.host/oauth/token \
   --authorize-url http://magento.host/oauth/authorize \
   --request-token-url http://magento.host/oauth/initiate \

1 Answer 1


This seems a problem of mod_rewrite OR SymLinks.

Please enable mod_rewrite :

sudo a2enmod rewrite

Now edit apache config file :

sudo gedit /etc/apache2/apache2.conf

and replace this code :

<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride none
Require all granted


<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted

Note: changed AllowOverride none to AllowOverride All

Now restart apache sudo service apache2 restart and check. This may fix your issue.

  • this is actually the confirguration: <Directory "/home/testing/public_html"> Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI allow from all AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch Require all granted AddType application/x-httpd-php .php AddHandler fcgid-script .php AddHandler fcgid-script .php5 FCGIWrapper /home/testing/fcgi-bin/php5.fcgi .php5 FCGIWrapper /home/testing/fcgi-bin/php5.fcgi .php </Directory> is not already ok?
    – apedic
    Commented Sep 2, 2016 at 10:50
  • just add these lines (shown in answer) <Directory /var/www/> Options Indexes FollowSymLinks AllowOverride All Require all granted </Directory> to apache config file Commented Sep 2, 2016 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.