Consumer is not authorized to access %resources Magento_Sales::sales

Question

I have this basic API script:

<?php
    ini_set('display_errors', 1);
    ini_set('display_startup_errors', 1);
    error_reporting(-1);

    $usr = [
        'username' => 'username',
        'password' => 'somePassword'
    ];

    $ch = curl_init('https://magentostore/index.php/rest/V1/integration/admin/token');

    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($usr));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'Content-Length: '. strlen(json_encode($usr))]);

    $token = curl_exec($ch);

    echo '<pre>';
    print_r($token);
    echo '</pre>';

    echo '========================';

    $ch = curl_init('https://magentostore/index.php/rest/V1/orders/1');

    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'Authorization: Bearer '. json_decode($token)]);

    $result = curl_exec($ch);

    $result = json_decode($result, 1);
    echo '<pre>'. print_r($result) .'</pre>';

but it returns this message:

Array ( [message] => Consumer is not authorized to access %resources [parameters] => Array ( [resources] => Magento_Sales::sales ) )

I'm not sure why, my script should work but I can't figure out why? Is it because of username account permissions? Shouldn't be as user = admin. Just trying to get array of orders ...

Alternative testing method that yielded same results:

I did:

curl -X POST 'https://magentostore/index.php/rest/V1/integration/admin/token' \
-H 'Content-Type:application/xml' \
-d '<login><username>admin</username><password>password</password></login>'

which got me the Token, which I then used like this:

curl -X GET https://magentostore/index.php/rest/V1/orders/1' -H 'Authorization: Bearer <Token that was returned>'

which gets me the same error as above

Edit:

I've tried with a few different API Endpoints and some work (like getting categories) but /orders still doesn't. I've tried on 3 separate environments and only 1 works:

Env One - Doesn't Work

OS: CentOS 7
PHP Version: 7.1
Magento Version: 2.2.5
Hosted outside of LAN

Env Two - Doesn't Work

OS: CentOS 7
PHP Version: 7.0
Magento Version: 2.2.5
Hosted outside of LAN

Env Three - DOES WORK

OS: Linux Mint 19
PHP Version: 7.2
Magento Version: 2.3-develop
localhost

are you sure you passing admin's username and password correct. — Aditya Shah, Oct 1, 2018 at 14:24
@AdityaShah no .. seems not needed? Just a way to develop APIs in IDE-format no? — treyBake, Oct 1, 2018 at 14:28

Aditya Shah · Accepted Answer · 2018-10-01 14:52:39Z

1. First setup Integrations

Open the System > Extensions > Integrations

Add New Integration

Set the integration Name and other settings, then specify your Magento 2 back-end password in the Your Password field

Switch to the API sidebar tab and select the resources which will be available to OAuth clients:

Press the Save button. The integration will be saved and the Integrations list will be shown again. Press the Activate link in the integration row:

A confirmation screen will be shown. Press the Allow button

The credentials screen will be shown. Use them in your third-party software to access your Magento 2 as OAuth server.

You will see:

Consumer Key

Consumer Secret

Access Token

Access Token Secret

Copy it to somewhere, then press the Done button.

The integration will be saved and the Integrations list will be shown again. You will see your integration in the Active state:

2. Now get admin token

<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => "http://magento.host/index.php/rest/V1/integration/admin/token?username=admin&password=admin123",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => array(
    "Cache-Control: no-cache",
    "Postman-Token: b7d053fe-df0d-4a85-ab82-4093a9be9d15"
  ),
));

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

3. add that Admin token

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => "http://magento.host/index.php/rest/V1/orders/1",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => array(
    "Authorization: Bearer <YOUR ADMIN TOKEN>",
    "Cache-Control: no-cache",
    "Postman-Token: 1057fee5-abde-4a88-bd39-2a623ca995e6"
  ),
));

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

forget about it, just tell me are you getting any admin TOKEN ? — Aditya Shah, Oct 1, 2018 at 14:48

Christian · Accepted Answer · 2019-09-02 11:26:40Z

I had the same Problem. In my case, the response of the token was wrapped in "", which passed to the next calling function could of cause not work. So I just stripped the "" from the response, and than it worked for me. Here is my working code to update the stock of an item via sku:

$config = array(
    'shop_url' => "%YOUR_SHOP_URL%",
    'username' => "%YOUR_ADMIN_BACKEND_USER%",
    'password' => "%YOUR_ADMIN_BACKEND_PASSWORD%",
);

$testSKU = "%YOUR_TEST_SKU%";


// Request Admin Token 
$url = $config['shop_url']."/rest/all/V1/integration/admin/token";

$data = "{ \"username\": \"".$config['username']."\", \"password\": \"".$config['password']."\"}";

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST,  "POST");
curl_setopt($ch, CURLOPT_HTTPHEADER,     array('Content-Type: application/json','accept: application/json')); 
curl_setopt($ch, CURLOPT_POSTFIELDS,     $data );

$response = curl_exec($ch);

if (!$response) 
{
    echo 'ERROR';
}

echo '<pre>';
var_dump($response);
echo '</pre>';

// Strip Response from unwanted Characters to save it as token
$token = str_ireplace('"', '', $response);


// Update qty for sku
$url = $config['shop_url']."/rest/V1/products/".$testSKU."/stockItems/1";

$data = '{"stockItem":{"qty":123}}';

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST,  "PUT");
curl_setopt($ch, CURLOPT_HTTPHEADER,     array('Content-Type: application/json','accept: application/json', 'Authorization: Bearer '.$token));
curl_setopt($ch, CURLOPT_POSTFIELDS,     $data );

$response = curl_exec($ch);

if (!$response) 
{
    echo 'ERROR';
}

echo '<pre>';
var_dump($response);
echo '</pre>';

Tested on Magento 2.3.2

I recommend watching youtu.be/9OpjTwifhaE
– Gediminas
May 16, 2021 at 16:47 — Gediminas, May 16, 2021 at 16:47

Amit Bera · Accepted Answer · 2018-10-01 14:25:13Z

0

The APi user 'username' => 'username' does not have proper access at sales section.

Please go to admin>System>Extension>Intregation and open check your user is active or not .

Second , this user is active then please check open that use and check it resource area setting

answered Oct 1, 2018 at 14:25

Amit Bera♦

77.1k20 gold badges117 silver badges236 bronze badges

1

what if the API user = admin user of Magento panel?
– treyBake
Oct 1, 2018 at 14:29

Add a comment |

lm713 · Accepted Answer · 2019-12-30 20:12:31Z

Try changing the PHP handler used by Apache on the Magento server. I also thought it was the PHP version, but then I realised the working version was using a different handler. I changed from cgi to suphp for the PHP version that was not working and the requests started to work. Interestingly, as mentioned in https://stackoverflow.com/questions/57028498/problem-with-magento-2-rest-authentication/59530132, POST requests would always work, but GET requests would fail. I have no idea why changing the handler solves the problem. Good luck.

Daniel T · Accepted Answer · 2020-10-19 05:22:34Z

0

I have been chasing my tail for hours on this ... :/

lm713: "Try changing the PHP handler used by Apache on the Magento server"

this did the trick, i am running magento 2 in cpanel environment and the php version was configured to use CGI as the PHP Handler. I changed it to suphp and all my api queries are now working!

answered Oct 19, 2020 at 5:22

Daniel T

1

Add a comment |

Konstantin Vahrushev · Accepted Answer · 2020-10-28 18:46:32Z

0

I had the same issue on PHP 7.1.33 After I switched to 7.2.31 the issue was fixed. Not sure why it was. Magento ver. 2.3.2

answered Oct 28, 2020 at 18:46

Konstantin Vahrushev

1212 bronze badges

Add a comment |

Jason · Accepted Answer · 2021-03-02 20:44:36Z

In my case, the issue was being caused by Apache. The "Consumer is not authorized"-error is a broad error, also being shown when the the Authorization-header is not being received by Magento.

Apparently Apache does not pass the Authorization-header to the website on default. It's Apache's default security behaviour.

Issue fixed by adding these lines to .htaccess:

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

Andrii Andriiets · Accepted Answer · 2021-07-29 11:42:49Z

0

Can be a redirects issue. During redirect (response with Location 301 header) the Authorization header might be lost. So you can try to avoid redirects. You can check redirects by getting cUrl code from Postman and add -v -L flags.

answered Jul 29, 2021 at 11:42

Andrii Andriiets

1

Add a comment |

Stack Exchange Network

Consumer is not authorized to access %resources Magento_Sales::sales

8 Answers 8

Your Answer

Not the answer you're looking for? Browse other questions tagged
magento2
api
sales-order
rest-api
or ask your own question.

Hot Network Questions

Consumer is not authorized to access %resources Magento_Sales::sales

8 Answers 8

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged magento2apisales-orderrest-api or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
magento2
api
sales-order
rest-api
or ask your own question.