0

I'm trying to call magento api from an external chat bot for customer service. For testing purposes, I'm using default magento get call on order (/V1/orders/{id} ).

If I create an admin (or customer) token (POST /V1/integration/admin/token), then my GET /V1/orders/{id} call is successful and I can see the order details for the given order id.

But if instead of using an admin/customer token I try to use an integration token, then my GET call gives an error "consumer is not authorized to access % resource" and the resource in question is "magento_sales::action_view".

I've also edit my integration token to select ALL api from resource access -- not ideal but just to test if it works -- but it doesn't work either, I get the same error.

My question is:

how can I use the integration token only (which means: without calling the admin/customer token, which I cannot do from the external chatbot) ?

and what's the use of the integration token if I have to call the admin/customer token anyway (which can work without the integration token so if I could I would just call them instead of the integration token) ?

Do I have to create a module/etc/webapi.xml? shouldn't be already fine, since it is a magento default api?

Thanks

PS: my current magento version is 2.4.3

1

3 Answers 3

1

In my opinion of this way

Magento, integration tokens are used to authorize access to the API resources for external applications or services. The purpose of integration tokens is to provide a secure and limited access to specific resources without exposing sensitive admin or customer credentials

When using an integration token, you need to configure the integration with the appropriate permissions to access the desired resources. In your case, the error message "consumer is not authorized to access % resource" indicates that the integration token does not have the necessary permissions to access the "magento_sales::action_view" resource.

To resolve this issue, you'll need to ensure that the integration token has the required permissions to access the order details

here give some steps to follow:

1.Log in to your Magento admin panel.

2.Go to System > Extensions > Integrations.

3.Create or edit the integration that corresponds to your external chatbot.

4.In the API section, make sure the "Sales > Actions > View" permission is selected.

5.Save the integration.

6.Generate a new integration token.

With the updated integration token, you should be able to make the GET /V1/orders/{id} call successfully without needing to obtain an admin or customer token. The integration token will provide the necessary authorization for the external chatbot to access the order details.

The advantage of using an integration token instead of an admin or customer token is that it allows you to provide limited access to specific resources without exposing more privileged credentials. This helps enhance security by following the principle of least privilege. Additionally, integration tokens can be revoked or regenerated independently, providing more control over access to the API.

0

1. Allow Anonymous Guest Access

Path : Stores -> Configuration -> Services -> Magento Web API -> Web API Security

Then select “Yes” from the Allow Anonymous Guest Access menu

2 Get Customer token

URL: https://example.com/rest/V1/integration/customer/token

Method :POST

Params

{
"username": "[email protected]",
"password": "example@123"
}
0

Found the issue.

My staging environment is protected on the server level, that's why my api call would not get through.. basically, I should first give the server credentials via basic auth and then give the token to authorize the call.. I'm still looking for a way to do this via postman

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.