I'm using this link as my model for testing the REST API, and I get all the way through the authorize prompt to a "403 Forbidden" response (this is for both the customer and admin examples).

Invalid auth/bad request (got a 403, expected HTTP/1.1 20X or a redirect)
{"messages":{"error":[{"code":403,"message":"Access denied"}]}}

STEP 1 - I access this example URL: http://mywebsite.net/oauth_admin.php

STEP 2 - I see the login prompt and log in, along with seeing the token in the URL: http://mywebsite.net/admin/oauth_authorize?oauth_token=a35aa73f8bda2fce1d5d4db25628129d enter image description here

STEP 3 - I get the desired authorize prompt: enter image description here

STEP 4 - I click authorize and I get the above 403 response.

I have setup the REST user and role as according to the instructions at the above link, and believe I have followed all other steps - multiple times. I'm at a loss as to why this fails.

Has anyone else experienced this issue? I've also tried using the Firefox and Chrome API extensions with the same result.

UPDATE: I found that someone else solved this issue when the request was passed over HTTPS. There is nothing in the tutorials mentioning a prereq SSL. Has anyone else successfully used REST without SSL? See their solution here--> Why do I get unauthorized for REST API

2 Answers 2


I can give you workable example:

System / Web Services / REST Roles

    Role info: 
Role Name: admin
Password: 123123
    Role API resources:
Resources access: All
    Role Users:
I have assigned admin user

System / Web Services / REST Attributes / Select {Admin}

Resources access: All

System / Web Services / REST OAuth Consumers

My magento url is mg1910.local.dev/

My magento url is http://mg1910.local.dev/

My http://mg1910.local.dev/oauth_admin.php is following:


/* live server */
$host = 'http://mg1910com.local.dev/';
$consumerKey    = '7e14cd85d05456c3e4de9e3c5c5f61e4';
$consumerSecret = 'f8aab713fa50504f0fac99d564ecaf7a';
/* << live server */

$callbackUrl = "http://mg1910com.local.dev/oauth_admin.php";
$temporaryCredentialsRequestUrl = $host . "oauth/initiate?oauth_callback=" . urlencode($callbackUrl);
$adminAuthorizationUrl = $host . "admin/oauth_authorize";
$accessTokenRequestUrl = $host . "oauth/token";
$apiUrl = $host . "api/rest";

if (!isset($_GET['oauth_token']) && isset($_SESSION['state']) && $_SESSION['state'] == 1) {
    $_SESSION['state'] = 0;
try {
    $oauthClient = new OAuth($consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1, $authType);

    if (!isset($_GET['oauth_token']) && !$_SESSION['state']) {
        $requestToken = $oauthClient->getRequestToken($temporaryCredentialsRequestUrl);
        $_SESSION['secret'] = $requestToken['oauth_token_secret'];
        $_SESSION['state'] = 1;
        header('Location: ' . $adminAuthorizationUrl . '?oauth_token=' . $requestToken['oauth_token']);
    } else if ($_SESSION['state'] == 1) {
        $oauthClient->setToken($_GET['oauth_token'], $_SESSION['secret']);
        $accessToken = $oauthClient->getAccessToken($accessTokenRequestUrl);
        $_SESSION['state'] = 2;
        $_SESSION['token'] = $accessToken['oauth_token'];
        $_SESSION['secret'] = $accessToken['oauth_token_secret'];
        header('Location: ' . $callbackUrl);
    } else {
        $oauthClient->setToken($_SESSION['token'], $_SESSION['secret']);
        $resourceUrl = "$apiUrl/products?limit=3";
        //$oauthClient->fetch($resourceUrl, array(), 'GET', array('Content-Type' => 'application/json'));
        $oauthClient->fetch($resourceUrl, array(), 'GET', array('Content-Type' => 'application/xml', 'Accept' => '*/*'));
        $productsList = json_decode($oauthClient->getLastResponse());
        echo "<pre>";
} catch (OAuthException $e) {
    echo "<br/>";

As you can see my script receive 3 products.

enter image description here


It seems like your server's "apache_request_headers" is disabled.

So, there are one of the two probable solutions:

  1. Contact your host and ask them to enable "apache_request_headers".
  2. Modify the getHeader($header) function in Zend_Controller_Request_Http class


$temp = 'HTTP_' . strtoupper(str_replace('-', '_', $header));


$temp = ($header == 'Authorization') ? $header : 'HTTP_' . strtoupper(str_replace('-', '_', $header));
  • The headers_module is enabled. There is no apache_request_headers module to enable. I have root access to the box and attempted to enable it.
    – gtr1971
    Commented Apr 27, 2015 at 21:19
  • Why do you assume he is using Apache?
    – scrowler
    Commented Jun 11, 2016 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.