We are trying to use the REST API for building a Mobile App. I'm able to retrieve the product list using following URL /api/rest/products as a guest.

However if i try to retrieve the product list as a customer using the following code which i got from magento tutorial, it ask for a user login. But even after entering a valid user name and password it just redirect to the login page of the website. What could be the issue? Am i missing some configuration changes.

I have done following steps to configure the REST API.

  1. Went to System-> Web Services -> REST Roles. Selected customer and under Roles and Resources selected All
  2. Went to System -> Web Service -> REST Attributes. Selected Customer, under ACL Attribute Rules selected ALL for Resource Access
  3. Went to System -> Web Service -> REST OAuth Consumer and added a new Consumer.

And in the following code i have used the key and secret from the consumer. When i run this code i can view a screen where i required to enter a email and password. I have entered a email and password which is listed under Customers -> Manage Customers. But when click login it just redirects to original page. Please see the images below

REST Login Page enter image description here

Page after login it redirects to following page enter image description here

    $callbackUrl = "http://localhost/mage_lab/magento/"; 
    $siteURL =  "http://localhost/mage_lab/magento";
    $temporaryCredentialsRequestUrl = "$siteURL/oauth/initiate?oauth_callback=" . urlencode($callbackUrl); 
    $adminAuthorizationUrl = "$siteURL/oauth/authorize"; 
    $accessTokenRequestUrl = "$siteURL/oauth/token"; 
    $apiUrl = "$siteURL/api/rest"; 
    $consumerKey = '3e234c9aa0e357306757765d0fbec702'; 
    $consumerSecret = '64e191eeb09d489c8fb876ac10ffecee';

    if (!isset($_GET['oauth_token']) && isset($_SESSION['state']) && $_SESSION['state'] == 1) {
         $_SESSION['state'] = 0; 
    try {
        $authType = ($_SESSION['state'] == 2) ? OAUTH_AUTH_TYPE_AUTHORIZATION : OAUTH_AUTH_TYPE_URI;
        $oauthClient = new OAuth($consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1, $authType);

        if (!isset($_GET['oauth_token']) && !$_SESSION['state']) {
            $requestToken = $oauthClient->getRequestToken($temporaryCredentialsRequestUrl);
            $_SESSION['secret'] = $requestToken['oauth_token_secret'];
            $_SESSION['state'] = 1;
            header('Location: ' . $adminAuthorizationUrl . '?oauth_token=' . $requestToken['oauth_token']);
        } else if ($_SESSION['state'] == 1) {
            $oauthClient->setToken($_GET['oauth_token'], $_SESSION['secret']);
            $accessToken = $oauthClient->getAccessToken($accessTokenRequestUrl);
            $_SESSION['state'] = 2;
            $_SESSION['token'] = $accessToken['oauth_token'];
            $_SESSION['secret'] = $accessToken['oauth_token_secret'];
            header('Location: ' . $callbackUrl);
        } else {
            $oauthClient->setToken($_SESSION['token'], $_SESSION['secret']);
            echo $resourceUrl = "$apiUrl/products/";
            $oauthClient->fetch($resourceUrl, array(), 'GET', array('Content-Type' => 'application/json', 'Accept' => 'application/json'));
            $productsList = json_decode($oauthClient->getLastResponse());
    catch (OAuthException $e) {

EDIT It working if i already login from website and then try to run the API code. Then it will directly show the Page with Authorize button instead of login page

1 Answer 1


Ok, I think i have found a solution, but not sure if I'm following the proper method. After analyzing i have found two problems with current customer login.

When tried to login as a customer from API login screen, the form does not pass field form_key.

After setting the form key the user will be able to login however the page will be redirected to Accounts page which is not wanted for REST API.

So i have edited


And added following code under form tag

<input type="hidden" name="form_key" value="<?php echo age::getSingleton('core/session')->getFormKey()?>"/>

Then overridden


And altered following code

$session->login($login['username'], $login['password']);
if ($session->getCustomer()->getIsJustConfirmed()) {
     $this->_welcomeCustomer($session->getCustomer(), true);

To this :

$session->login($login['username'], $login['password']);
if ($session->getCustomer()->getIsJustConfirmed()) {
       $this->_welcomeCustomer($session->getCustomer(), true);

    $apiAuthorizeURL = age::getBaseUrl().'oauth/authorize?oauth_token='.$this->getRequest()->getPost('oauth_token');

I have added an extra if condition which is checking for parameter oauth_token and if there is such a parameter i'm assuming that its a login attempt from a REST API call and redirects to authorization page.

It is working, but i'm not sure if its good method or if there is any security issues since since i'm merely redirects assuming it as a REST API call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.