Authentication (OAuth 1.0a)

Nota (PT-BR): a REST API usa OAuth 1.0a (3-legged). Os três passos abaixo são obrigatórios.

OAuth Authentication

Magento uses OAuth 1.0a — a token-passing mechanism that allows users to control which applications have access to their data without revealing their passwords.

Key Definitions

• User — the Magento user (admin or customer) granting access
• Consumer — the third-party application
• Consumer Key / Consumer Secret — identify the consumer
• Request Token — temporary credential used to request access
• Access Token — long-lived credential granted after authorization

OAuth Process — three steps

1. POST /oauth/initiate — get an unauthorized Request Token.
2. GET /oauth/authorize (customer) or /admin/oauth_authorize (admin) — user authorization.
3. POST /oauth/token — exchange Request Token for Access Token.

Authorization Header

Every REST request must include:

• oauth_consumer_key
• oauth_nonce
• oauth_signature_method (HMAC-SHA1, RSA-SHA1 or PLAINTEXT)
• oauth_signature
• oauth_timestamp
• oauth_token
• oauth_version

OAuth Error Codes

• 1 / 400 — version_rejected
• 2 / 400 — parameter_absent
• 3 / 400 — parameter_rejected
• 4 / 401 — timestamp_refused
• 5 / 401 — nonce_used
• 6 / 400 — signature_method_rejected
• 7 / 401 — signature_invalid
• 8 / 401 — consumer_key_rejected
• 9 / 401 — consumer_key_unknown
• 10 / 401 — token_used
• 11 / 401 — token_expired
• 12 / 401 — token_revoked
• 13 / 401 — token_rejected

OAuth Configuration

Working with Consumers

1. System > Web Services > REST - OAuth Consumers.
2. Click Add New and fill in Name, Callback URL and Rejected Callback URL.
3. Key and Secret are auto-generated and cannot be edited.

Token Management (Admin)

• View authorized tokens at System > Web Services > REST - OAuth Authorized Tokens.
• Mass actions: enable, revoke, delete.

Token Management (Frontend)

Customers manage their apps at My Account > My Applications.

Cleanup Configuration

Set the probability threshold and expiration period (minutes) for temporary token cleanup at System > Configuration > Services > OAuth.