Using Api with Admin account

[SachaMorard]

Hello

I'm trying to use rest api with an admin user account.
I get the token properly : POST http://magento2.local/rest/V1/integration/admin/token?username=myadminuser&password=mypassword

Next, when I do an api call, it's seems $this->_aclRoleLocator->getAclRoleId() in Magento\Framework\Authorization always return NULL.
I tried to add token param to header, get param, sharp param... with name "oauth_token", or "token". Is there a problem ?

By the way, will Magento2 support oauth2 ?

Best regards and thank you.
Sacha

[verklov]

@sachoo, thank you for your question! I have forwarded your question for the team. Let's wait for them to investigate and respond. We will get back to you once there is a response ready.

[choukalos]

EDIT for last question:

Currently we support an OAuth v1 style handshake for system to system integrations. We support an oath v2 style for mobile/ajax API calls. From a security standpoint we've chosen to make system api calls using v1 for higher security. If you feel we should support v1 or v2 strongly please don't hesitate to ping me @choukalos.

----- Original Thread ---------

@sachoo - Which API are you calling? I talked to Anup (one of our API devs); maybe you didn't set the auth header correctly - it should be "Authorization: Bearer YOURADMINTOKEN".

Check out this file ( I pulled info from our internal wiki and just verified it on a recent pull from the repo ): https://github.com/choukalos/M2_Api_Example_Scripts/blob/master/README-AUTHSTYLES.md . In that repository I've created some yaml files and a simple ruby script to exercise Magento 2 apis. If you have any feedback for the api's please send them my way.

Thanks,
Chuck (Product Manager for Magento APIs)

[SachaMorard]

Hi Chuck

Thank you very much for your time. You're right, I didn't write the header correctly. I missed "Bearer" attribute.

Thank you very much.
Sacha

[nyov]

If you feel we should support v1 or v2 strongly please don't hesitate to ping me @choukalos.

@choukalos, my vote is to keep OAuth v1, as said, for it's saner security.
And thanks for the linked api documents, they really helped.