I would like to programmatically create an api role with the installation of a module. I have a data install script located at


How should I go about doing this?

Something perhaps like?:

$apirole = Mage::getModel('api/role')->setData(array(''=>''));

2 Answers 2


I ended up doing something like the following in my data-install-1.0.0.php script, which creates a new role and user with 'all' privileges.

$api_key = "your_key_here";

$api_role = Mage::getModel('api/roles')


$api_user = Mage::getModel('api/user');

        'username' => '<module>',
        'firstname' => '<module>',
        'lastname' => '<module>',
        'email' => 'support@<module>.com',
        'api_key' => $api_key,
        'api_key_confirmation' => $api_key,
        'is_active' => 1,
        'user_roles' => '',
        'assigned_user_role' => '',
        'role_name' => '',
        'roles' => array($api_role->getId())



Of course this is simplified, you would likely want to include some error handling.

UPDATE: If you're following along you may run into an issue with the above code not saving your api key. If so try the following:

$salt = ('somekindofsalthere');

$api_key = md5($salt.'somekindOfPasswordHere02').':'.$salt;

Now, rather than using $api_user->setData() with api_key and api_key_confirmation, we're going to set the api key this way (notice the above 2 parameters have been removed and replaced with a new method below):

            'username' => '<module>',
            'firstname' => '<module>',
            'lastname' => '<module>',
            'email' => 'support@<module>.com',
            'is_active' => 1,
            'user_roles' => '',
            'assigned_user_role' => '',
            'role_name' => '',
            'roles' => array($role->getId())

This should save your key to your newly created api user. Keep in mind the api key will not display on the backend, as those fields are for updating to a new key, and will not display the current key.

  • 1
    Thanks Tim. It worked. Though your script need to fix $user->getUserId(). It should be $api_user->getUserId()
    – Amit Patel
    Nov 17, 2017 at 10:25

I expect that others (like me) will find this question in search of a pure-SQL method of creating these API users. Below you can find a solution for creating a new API user with "All" permissions. Just modify the first few variables to set your desired user/pass, then run these queries against the database.

SET @api_password='super_secret'; -- Set your desired API password here
SET @api_username='export_connector'; -- Set your desired API username here
SET @api_email='[email protected]'; -- Change this if you want.

SELECT @api_password_hash:=md5(@api_password);

INSERT INTO `api_role` (`role_id`, `parent_id`, `tree_level`, `sort_order`, `role_type`, `user_id`, `role_name`)
    (NULL, 0, 1, 0, 'G', 0, 'Export Connector');

SELECT @new_role_id:=LAST_INSERT_ID();
INSERT INTO `api_rule` (`rule_id`, `role_id`, `resource_id`, `api_privileges`, `assert_id`, `role_type`, `api_permission`)
    (NULL, @new_role_id, 'all', NULL, 0, 'G', 'allow');

INSERT INTO `api_user` (`user_id`, `firstname`, `lastname`, `email`, `username`, `api_key`, `created`, `modified`, `lognum`, `reload_acl_flag`, `is_active`)
    (NULL, 'Export', 'Connector', @api_email, @api_username, @api_password_hash, NOW(), NOW(), 0, 0, 1);

SELECT @new_user_id:=LAST_INSERT_ID();
INSERT INTO `api_role` (`role_id`, `parent_id`, `tree_level`, `sort_order`, `role_type`, `user_id`, `role_name`)
    (NULL, @new_role_id, 1, 0, 'U', @new_user_id, 'Export');

If you use table prefixes, you'll need to change the table names. You can probably change the firstname/lastname/role name too, but I didn't try.

Reason for doing this with pure-SQL is that we manage hundreds of Magento stores, each with differing codebases. We needed to get API access into them to pull data out, without making [testing] code changes in each store, and manually creating these would be extremely tedious.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.