Authentication Tokens

Obtain Admin Token

curl -X POST 'https://store.com/rest/V1/integration/admin/token' \
     -H 'Content-Type: application/json' \
     -d '{
         "username": "admin",
         "password": "admin123"
     }'

Response

{
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Use Admin Token

curl -X GET 'https://store.com/rest/V1/products' \
     -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'

Admin Token Properties

• Access to all admin resources
• No store scope limitation
• Can perform any operation
• Expiration: Configurable (default: 4 hours)

Token Configuration

# Set token lifetime (in seconds)
bin/magento config:set admin/security/token/lifetime 14400

# Default: 14400 (4 hours)

Obtain Customer Token

curl -X POST 'https://store.com/rest/V1/integration/customer/token' \
     -H 'Content-Type: application/json' \
     -d '{
         "username": "customer@example.com",
         "password": "password123"
     }'

Response

{
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Use Customer Token

# Get customer info
curl -X GET 'https://store.com/rest/V1/customers/me' \
     -H 'Authorization: Bearer customer_token'

# Get customer orders
curl -X GET 'https://store.com/rest/V1/customers/me/orders' \
     -H 'Authorization: Bearer customer_token'

Customer Token Limitations

• Only access customer resources
• Scoped to customer's data
• Cannot access admin resources
• Expiration: Configurable

Token Scope

// Customer token only allows:
// - Customer profile (GET /V1/customers/me)
// - Customer orders (GET /V1/customers/me/orders)
// - Customer addresses (GET /V1/customers/me/addresses)
// - Cart operations (POST /V1/carts/mine)

Create Integration

Admin > System > Integrations > Add New Integration

1. Name: My API Integration
2. Callback URL: https://myapp.com/callback
3. Identity Link URL: https://myapp.com/authorize
4. Resources:
   - Magento_Catalog::products
   - Magento_Sales::orders
5. Save and Activate

Integration Token Response

{
    "consumer_key": "abc123...",
    "consumer_secret": "def456...",
    "token": "ghi789...",
    "token_secret": "jkl012..."
}

OAuth Authentication

# Step 1: Get request token
curl -X POST 'https://store.com/oauth/initiate' \
     -o oauth_token=

# Step 2: User authorizes
# Redirect to: https://store.com/oauth/authorize?oauth_token=

# Step 3: Get access token
curl -X POST 'https://store.com/oauth/token'

Integration Token Properties

• Scoped to selected resources
• Can be limited by store view
• Supports OAuth 1.0a
• No expiration (unless revoked)

Token Expiration

Token Refresh

// Refresh admin token
public function refreshToken(string $oldToken): string
{
    // Token automatically refreshes on use
    // Or explicitly request new token
    $newToken = $this->tokenService->createAdminToken(
        $username,
        $password
    );
    
    return $newToken;
}

Token Storage

// Secure storage
class TokenStorage
{
    public function store(string $token): void
    {
        // Encrypt before storage
        $encrypted = $this->encryptor->encrypt($token);
        $this->cache->save($encrypted, 'api_token');
    }
    
    public function get(): string
    {
        $encrypted = $this->cache->load('api_token');
        return $this->encryptor->decrypt($encrypted);
    }
}

Token Revocation

// Revoke integration token
public function revokeIntegration(int $integrationId): void
{
    $integration = $this->integrationFactory->create();
    $this->integrationResource->load($integration, $integrationId);
    $integration->setStatus(0);
    $this->integrationResource->save($integration);
}

Best Practices

• Store tokens securely (encrypted)
• Use HTTPS only
• Rotate tokens regularly
• Implement token expiration checks
• Log token usage