I am getting data from magento2 REST api. I send admin credentials to get the token then I use the token to get the data and everything is working fine.

Is it a safe way to do that? Should I create another user with specific permissions for accessing REST api on magento? What is the recommended way to do it?

I am using the below code:

    //Authentication rest API magento2
    $ch = curl_init();
    $var = 
    $data = array("username" => "username", "password" => 'password');                                                                    
    $data_string = json_encode($data);                       
    $ch = curl_init($adminUrl); 
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");                                                                     
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);                                                                  
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);                                                                      
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(                                                                          
        'Content-Type: application/json',                                                                                
        'Content-Length: ' . strlen($data_string))                                                                       
    $token = curl_exec($ch);
    $token=  json_decode($token); 
    $ch = curl_init( "http://domain.com/index.php/rest/V1/products?searchCriteria[pageSize]=10&fields=items[id,name,sku,price,status]" );

    $curlOptions = array(
        CURLOPT_HTTPHEADER     => array(
            "Content-type: application/json",
            "Authorization: bearer ".$token

    curl_setopt_array( $ch, $curlOptions );

    $response = curl_exec( $ch );

    return $response;  

There are two aspects here:

  1. How safe is the transport?

    in your case, not safer than a postcard, because you use HTTP and anybody between your device and the server could inspect every detail of request and response.


    1. Add an SSL certificate if you don't have any yet. you can get a free one at https://letsencrypt.org/ - this is also important for the security of your customers!
    2. Use https://example.com instead of http://example.com for your API calls.
  2. Should you use a dedicated API user?

    It's generally a good rule of thumb to only allow as much as necessary. So, yes you should create one or more separate users for API access that receive just as much permissions as they need.

| improve this answer | |
  • I have SSL added on the server, Ican visit the website using HTTPS. When I changed the URL in the above code to use HTTPS, it returned null!! It works on HTTP only. Any Help? – Moe Hammadi Apr 25 '17 at 21:42
  • Maybe the certificate was not accepted. Use curl_error() to see error messages from CURL and find out more. – Fabian Schmengler Apr 26 '17 at 6:44
  • I got this error: "error:SSL certificate problem: self signed certificate in certificate chain" – Moe Hammadi Apr 26 '17 at 6:48
  • 1
    OK, I would recommend you to replace the self signed certificate with a trusted one (users will get warnings in their browser about an untrusted certificate, that's not good for business). Until then, you can switch off verification, as explained here: stackoverflow.com/questions/13690173/… (warning: unsafe!) – Fabian Schmengler Apr 26 '17 at 6:53
  • Is it a server side certificate issue ?? I am sending the request from the localhost to the magento hosted website. – Moe Hammadi Apr 26 '17 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.