I have a site outside Magento's domain and I should allow Magento customer to login into Magento Store from this external site. Being completely new to Magento , I don't know how to implement this service. I was able to allow registration to Magento from an external site using REST API, but I can't find a similar way to login using REST services.

2 Answers 2


You can use REST API also. Magento 2 framework builds in already a list of useful API functions.

Token-based authentication

To make a web API call from a client such as a mobile application, you must supply an authentication token on the call. The token acts like an electronic key that lets you access the API.


So, in your case, for example, we have a login form on your site. We have two input fields: username and password. In your controller, we can get these values and pass to the Magento API. A successful response will return with a token which is used for authentication on the Magento side.

$username = $_POST['email'];
$password = $_POST['password']

$userData = array("username" => $username, "password" => $password);
$ch = curl_init("http://mage21.loc/rest/V1/integration/customer/token");
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($userData));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: application/json", "Content-Lenght: " . strlen(json_encode($userData))));

$token = curl_exec($ch);
  • ok, but then how can I set session cookie for customer so that he results logged into magento? Commented Mar 17, 2017 at 23:31
  • Where you want to set the cookie? Commented Mar 17, 2017 at 23:58
  • in the same php script that I wrote, I'd like to set session cookie into customer browser and then redirect him to magento site , being already logged in :) Commented Mar 18, 2017 at 0:27
  • Seem that you want to log in to Magento site automatically? Commented Mar 18, 2017 at 0:35
  • yes that's right Commented Mar 18, 2017 at 0:41

I found a solution : - On external site (on sub-domain) i created a cookie with magento token (generated by magento api: /customer/token don't sure about the name of the API) - On magento site (on sub-domain) i created an event-listener on each page except logout page, on this observer i check if there is a token in cookie, if yes i check that this token is present in magento database, if yes i login user

It's work perfectly but you need to be on the same domain or sub-domain for cookies


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.