Magento2 graphql query with access token

Question

How can we add the header parameters in graphql (altair) with authorisation token like postman.

In magento2 we have an option in admin system->intergration and we can the add new integration it will generate life time access token for accessing the magento2 data.

So,We need to restrict without this integration access token in headers parameter we don't allow the data by graphql.

How can we do this?

Answer 1

For Authorisation, You need to follow the below steps.

Step 1 : Generate Customer Token : The generateCustomerToken mutation requires the customer email address and password in the payload, as shown in the following example.

By default, a customer token is valid for 1 hour. You can change these values from Admin by selecting Stores > Settings > Configuration > Services > OAuth > Access Token Expiration > Customer Token Lifetime.

//Mutation for Generate Customer Token
mutation {
  generateCustomerToken(email: "[email protected]", password: "yourpassword") {
    token
  }
}

//Response of Generate Customer Token.
{
  "data": {
    "generateCustomerToken": {
      "token": "eyJraWQiOiIxIiwiYWxnIjoiSFMyNTYifQ.eyJ1aWQiOjIsInV0eXBpZCI6MywiaWF0IjoxNjc2MzU4MTc0LCJleHAiOjE2NzYzNjE3NzR9.RZqhl468dt1KinPduhKbbfHdeE8Xo1hpEMAP5Trl8RE"
    }
  }
}

Screenshot of Generate Customer Token Graphql API

Step 2 : Set Authorisation in the headers for GraphQL API. Please follow the below Altair screenshots for the same.

Hover on an icon, Which shows the set header option, Click on that. Find the below screenshot for the same.

Please note Add Key as Authorization & Value as Bearer & token. Provide space between Bearer & Tocken. Select the Checkbox and finally click on the Save button. Please check the below screenshot for the same.

Finally, You can access any API using this customer token. You can now use this token in the Authorization request header field for any queries and mutations. Find the below all customer detail API screenshots for your reference.

Refer to Official Magento Docs for more details about GraphQL Authorization Token.

Answer 2

We can customise logic and we can restrict but if we are using the authorisation Graphql will not cacheble. If you want please use below logic

protected $tokenModelFactory;
protected $requestInterface;

public function __construct(

\Magento\Framework\App\RequestInterface $requestInterface,
\Magento\Integration\Model\Oauth\TokenFactory $tokenModelFactory,
){
  $this->requestInterface = $requestInterface;
  $this->tokenModelFactory = $tokenModelFactory;
 }

 public function resolve(
        Field $field,
        $context,
        ResolveInfo $info,
        array $value = null,
        array $args = null
)   {
      $authorization = '';
      $headers = $this->requestInterface->getHeader('Authorization');
      if($headers == true) {
        $authorization = str_replace("Bearer ","",$headers);
      }
     $tokenCollection = $this->tokenModelFactory->create()->loadByToken($authorization);
    $consumerId = $tokenCollection->getData('consumer_id');
    if($consumerId == '' || $authorization == '')  {
    throw new GraphQlAuthorizationException(__('Invalid authorization token'));
}