The rest documentation for Magento 1 make mention of an oauth_admin.php file

$callbackUrl = "http://yourhost/oauth_admin.php";
$temporaryCredentialsRequestUrl = "http://yourhost/oauth/initiate?oauth_callback=" . urlencode($callbackUrl);
$adminAuthorizationUrl = 'http://yourhost/admin/oAuth_authorize';
$accessTokenRequestUrl = 'http://yourhost/oauth/token';
$apiUrl = 'http://yourhost/api/rest';
$consumerKey = 'yourconsumerkey';
$consumerSecret = 'yourconsumersecret';

This appears to be the file/URL that oauth will redirect to after the User Authorization step.

The docs fails to clearly say what this oauth_admin.php program/script needs to do with the oauth_token and and oauth_verifier variables it receives in order to work with the rest of the code sample.

Does this file exist anywhere in the docs and/or elsewhere? If not is there known science for getting Magento 1's three legged oauth working?

2 Answers 2


oauth_admin.php is just a stand-alone PHP Oauth client script which can be your callbackurl. You can replace this with your controller and action url path. Its involved in all the three legged authentication.

So the very file which you have pasted and find here in the doc is the actual oauth_admin.php

A quick overview of the Three legged authentication in this file

  1. Get the initial temporary request token.
    $oauthClient = new OAuth($consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1, $authType);

    // it returns an array with two values oauth_token (request token) and oauth_token_secret , eventually both of these will be used to get the access token and secret
    $requestToken = $oauthClient->getRequestToken($temporaryCredentialsRequestUrl);
  1. Validate and confirm / reject the admin Oauth authorization request.
   // where $adminAuthorizationUrl is http://magentohost/admin/oauth_authorize and oauth_token is the request token
   header('Location: ' . $adminAuthorizationUrl . '?oauth_token=' . $requestToken['oauth_token']);
  1. Exchange the temporary request token and secret to get the final access token and secret, which enables the user to access the resources they are allowed to access.
     $oauthClient->setToken($_GET['oauth_token'], $_SESSION['secret']);
     $accessToken = $oauthClient->getAccessToken($accessTokenRequestUrl);

In this script, you can find the values are persisted in the session to remember the authentication step and the request and access tokens with their secret tokens.

Similar to the admin user, the customer is also allowed to access the resources allowed for them. In this case, only the authorization url is different http://magentohost/oauth/authorize

Mage_Oauth module handles all the Oauth requests and responds appropriately.

  • Ah, I see now, thank you. I had thought of the sample program as "the code doing the requesting" and the callback URL as "the program that redirects back to the the program that needs the keys". I wasn't obvious (until you stated so) that Magento's sample program is written in such a way that it's just a simple program handling everything. Feb 18, 2020 at 1:10
  • no problem am glad that my answer clarifies...Yes i do agree the document was not so explicit to give the reader more clarity...i'll edit this on github to add more clarity to the further readers of this.
    – Haijerome
    Feb 18, 2020 at 4:54
  • just made a pull request github.com/magento/devdocs-m1/pull/25 to the M1.x Dev Docs
    – Haijerome
    Feb 18, 2020 at 6:19

The oauth_token and oath_verifier is used to retrieve the oath_access_token That will be used for your subsequent requests to query products etc.

$stack = HandlerStack::create();
$middleware = new Oauth1([
    'callback' => 'https://myapp.dev/not-magento-url/',
    'consumer_key' => $consumerKey,
    'consumer_secret' => $consumerSecret,
    'token' => $token,
    'token_secret' => $tokenSecret,
    'verifier' => $verifier,


// Client here is a GuzzleHttp\Client
$client = new Client([
    'base_uri' => $magentoApiBaseUrl,
    'handler' => $stack,

$response = $client->post('oauth/token', [
    'auth' => 'oauth',
    'allow_redirects' => true,

// response should contain the access token / details needed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.