4

Is there is a built in REST API for sign out in Magento because I looked in the reference and couldn't find?

3 Answers 3

2

Currently, my Magento version is 2.1.5, I cannot find the API for the "sign out" function. However, seem that Magento builds the revoked token by customer id method already.

vendor/magento/module-integration/Api/CustomerTokenServiceInterface.php

vendor/magento/module-integration/Model/CustomerTokenService.php::revokeCustomerAccessToken()

[NOT TEST MY CODE]

app/code/Vendor/Integration/etc/webapi.xml

<?xml version="1.0"?>

<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Webapi:etc/webapi.xsd">
    <route url="/V1/integration/customer/revoke" method="POST">
        <service class="Vendor\Integration\Api\CustomerRevokeTokenServiceInterface"
                 method="revokeCustomerAccessToken"/>
        <resources>
            <resource ref="anonymous"/>
        </resources>
    </route>
</routes>

app/code/Vendor/Integration/etc/di.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Vendor\Integration\Api\CustomerRevokeTokenServiceInterface"
                type="Vendor\Integration\Model\CustomerRevokeTokenService" />
</config>

app/code/Vendor/Integration/Api/CustomerRevokeTokenServiceInterface.php

<?php

namespace Vendor\Integration\Api;
/**
 * Interface CustomerRevokeTokenServiceInterface
 * @package Vendor\Integration\Api
 */
interface  CustomerRevokeTokenServiceInterface 
{
    /**
     * Revoke token by customer id.
     *
     * @api
     * @param int $customerId
     * @return bool
     * @throws \Magento\Framework\Exception\LocalizedException
     */
    public function revokeCustomerAccessToken($customerId);
}

app/code/Vendor/Integration/Model/CustomerRevokeTokenService.php

<?php

namespace Vendor\Integration\Model;

use Magento\Customer\Api\AccountManagementInterface;
use Magento\Framework\Exception\LocalizedException;
use Magento\Integration\Model\CredentialsValidator;
use Magento\Integration\Model\Oauth\Token as Token;
use Magento\Integration\Model\Oauth\TokenFactory as TokenModelFactory;
use Magento\Integration\Model\ResourceModel\Oauth\Token\CollectionFactory as TokenCollectionFactory;
use Magento\Integration\Model\Oauth\Token\RequestThrottler;
use Magento\Framework\Exception\AuthenticationException;

class CustomerRevokeTokenService
    implements \Vendor\Integration\Api\CustomerRevokeTokenServiceInterface
{
    /**
     * Token Model
     *
     * @var TokenModelFactory
     */
    private $tokenModelFactory;

    /**
     * Customer Account Service
     *
     * @var AccountManagementInterface
     */
    private $accountManagement;

    /**
     * @var \Magento\Integration\Model\CredentialsValidator
     */
    private $validatorHelper;

    /**
     * Token Collection Factory
     *
     * @var TokenCollectionFactory
     */
    private $tokenModelCollectionFactory;

    /**
     * @var RequestThrottler
     */
    private $requestThrottler;

    /**
     * Initialize service
     *
     * @param TokenModelFactory $tokenModelFactory
     * @param AccountManagementInterface $accountManagement
     * @param TokenCollectionFactory $tokenModelCollectionFactory
     * @param \Magento\Integration\Model\CredentialsValidator $validatorHelper
     */
    public function __construct(
        TokenModelFactory $tokenModelFactory,
        AccountManagementInterface $accountManagement,
        TokenCollectionFactory $tokenModelCollectionFactory,
        CredentialsValidator $validatorHelper
    ) {
        $this->tokenModelFactory = $tokenModelFactory;
        $this->accountManagement = $accountManagement;
        $this->tokenModelCollectionFactory = $tokenModelCollectionFactory;
        $this->validatorHelper = $validatorHelper;
    }

    /**
     * {@inheritdoc}
     */
    public function revokeCustomerAccessToken($customerId)
    {
        $tokenCollection = $this->tokenModelCollectionFactory->create()->addFilterByCustomerId($customerId);
        if ($tokenCollection->getSize() == 0) {
            throw new LocalizedException(__('This customer has no tokens.'));
        }
        try {
            foreach ($tokenCollection as $token) {
                $token->setRevoked(1)->save();
            }
        } catch (\Exception $e) {
            throw new LocalizedException(__('The tokens could not be revoked.'));
        }
        return true;
    }

}

Remember to create registration.php and module.xml files.

We can use the revoke customer access token: /V1/integration/customer/revoke

8
0

Since you use token authentication, simply delete the token from your client.

Revoking the token would only be useful if you want to force a log out from the server side, like if you changed the password.

0

Yes, there is a build in REST API to sign out of Magento.

POST /rest/default/V1/integration/customer/revoke-customer-token

without any parameter, but set the token as bearer token, and it will revoke the token.

Example:

#1 Sign in using the following API

POST /rest/V1/integration/customer/token
{"username":"[email protected]", "password":"Abc_123"}

#2 Get the customer information using this API and setting #1 Sign in API response as bearer token

GET /rest/V1/customers/me/

#3 Then call this API to revoke customer token or sign out. (setting #1 Sign in API response as bearer token)

POST /rest/V1/integration/customer/revoke-customer-token

Now again call #2 Get Customer Information API and you won't be able to do so, because token is revoked.

Look for these and more APIs documentation in ReDocly: https://developer.adobe.com/commerce/webapi/rest/quick-reference/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.