i'm creating customers with the REST-API and trying to give each customer an initial password. Problem is, that when the customers try to log on to the shop with their mail-address, loggin in is rejected because of a wrong password.

This is my code for creating customers in C#:

customerLocal.Password = "defaultpassword123!";  
customerLocal.TaxVat = String.Empty;  
customerLocal.CustomerCategory = "3";  
request = new RestRequest("customers", Method.POST);  
request.RequestFormat = DataFormat.Json;  
restClient = new RestApiClient();  
restResult = restClient.Execute(request);  

after executing, customer is created, but the password isn't accepted when logging in.

I've also tried to encrypt the password with md5:

customerLocal.Password = System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile("defaultpassword123!", "MD5");

This isn't working too.

  • 2
    have you assign the roles to that user?
    – Keyul Shah
    Commented Oct 16, 2014 at 6:07
  • hi keyul, stackoverflow.com/questions/25055700/… can you please explain the step 1 ), means can you give complete code for the step 1 in above link . thanks in advance Commented Jul 1, 2015 at 7:55
  • Hi @Michael, how did you resolve this problem? Thanks
    – d4v1dv00
    Commented Jul 14, 2015 at 11:34

3 Answers 3


I tried this already then I study about this, As according to my knowledge its unable to set password for the customer from API. Because in magento they are using a filter inside the customer create methode like this $data = $validator->filter($data);. So here the password which we sent is filtered. To avoid this I get the password before filter and set it after the filter as shown below. Change REST API customer create method in magento like this, it may solve your problem.

protected function _create(array $data)
        $password = $data['password'];
        $validator = Mage::getResourceModel('api2/validator_eav', array('resource' => $this));
        $data = $validator->filter($data);
        $data['password'] = $password;
        if (!$validator->isValidData($data))
            foreach ($validator->getErrors() as $error)
                $this->_error($error, Mage_Api2_Model_Server::HTTP_BAD_REQUEST);

        $customer = Mage::getModel('customer/customer');

            $customer->setPassword($data['password']);      //added

        catch (Mage_Core_Exception $e)
            $this->_error($e->getMessage(), Mage_Api2_Model_Server::HTTP_INTERNAL_ERROR);
        catch (Exception $e)
  • hi Remees, i saw your answer in this post : stackoverflow.com/questions/25055700/… can you please explain the step 1 ), means can you give complete code for the step 1 . thanks in advance Commented Jul 1, 2015 at 7:54
  • 1
    @BabyinMagento2 Its only that much, you have to specify the email and password, after that check if($result){ //user is exist} else{//user does not exist} Commented Jul 1, 2015 at 8:56
  • i added this code : pastebin.com/s8tCpi0t at hotwheelstoys.in/demo2/em0113-full-package/Mage.php is the code format is right? please correct it if it is wrong. Commented Jul 1, 2015 at 9:17
  • 1
    It seems the code is correct, but i don't know that's work or not because your calling the full URL, What i done is i just place the php file some where in the server and include the file like require_once('../magentositefoldername/app/Mage.php'); Commented Jul 1, 2015 at 9:27
  • 1
    Ohh, so there might some problem. But i dont know what our doing wrong :(. Commented Jul 2, 2015 at 11:40

(Should be a comment to @d4v1dv00 but I don't have enough reputation for it).

Previous answer from @RemeesMSyde doesn't work (anymore) out of the box with Magento 1.9.1. You need also to patch Resource.php as follow:

diff --git a/app/code/core/Mage/Api2/Model/Resource.php b/app/code/core/Mage/Api2/Model/Resource.php
index 5577628..ca6b3ab 100644
--- a/app/code/core/Mage/Api2/Model/Resource.php
+++ b/app/code/core/Mage/Api2/Model/Resource.php
@@ -219,10 +219,14 @@ abstract class Mage_Api2_Model_Resource
                 // The create action has the dynamic type which depends on data in the request body
                 if ($this->getRequest()->isAssocArrayInRequestBody()) {
+                    $password = isset($requestData['password']) ? $requestData['password'] : "";
                     $filteredData = $this->getFilter()->in($requestData);
                     if (empty($filteredData)) {
+                    if ($password) {
+                        $filteredData['password'] = $password;
+                    }
                     $newItemLocation = $this->_create($filteredData);
                     $this->getResponse()->setHeader('Location', $newItemLocation);
                 } else {

Btw, is there a way to modify this part without patching core files?

  • 1
    hi @sebbrochet, the solution works together with RemeesMSyde's patch. TQ
    – d4v1dv00
    Commented Jul 17, 2015 at 11:06

in this xml file add password field such as

                <confirmation>Is Confirmed</confirmation>

dir : app/code/core/Mage/Customer/etc/api2.xml

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.