How do I avoid 401 (Unauthorized) when creating a new API endpoint for Solidus / Spree?

Question

I'm doing a PUT "/api/shipments/H10372375236/ready_for_pickup", but that stops in Spree::BaseController#authenticate_user. My PUT request does not contain any X-Spree-Token header as required by BaseController#api_key

This is the code for my button:

 <%= form_tag(spree.api_ready_for_pickup_path(shipment), { method: "PUT", remote: true, id: "admin-ship-shipment" }) do %>
   <%= submit_tag Spree.t(:ready_for_pickup), class: "ship-shipment-button" %>
 <% end %>

This is my routes:

Spree::Core::Engine.routes.draw do
  namespace :api, defaults: { format: 'json' } do
    put '/shipments/:id/ready_for_pickup' => 'shipments#ready_for_pickup', as: :ready_for_pickup
  end
end

Rails.application.routes.draw do    
  mount Spree::Core::Engine, :at => '/' 
end

rake routes available as a Gist here. I have created an API key for the current user in the admin interface. How do I make sure the PUT request contain the missing X-Spree-Token?

score 0 · Answer 1 · edited May 23 '17 at 12:07

0

I would be in favor of that SO answer, which is to set the header in the update action of your controller like so:

response.headers["X-Spree-Token"] = auth_token

edited May 23 '17 at 12:07

Community

1
1

answered Apr 06 '16 at 12:55

born4new

1,677
12
12

`auth_token` is not present in `Spree::Api::ShipmentsController` – martins Apr 06 '16 at 13:04
Here, `auth_token` is to be replaced with your "X-Spree-Token" ;) – born4new Apr 06 '16 at 13:05
Yeah, but as I write in the initial post, I have no X-Spree-Token. :-( – martins Apr 06 '16 at 13:13
Your x-spree-token IS your api key! (check out https://guides.spreecommerce.com/api/summary.html at "Making an API Call") – born4new Apr 06 '16 at 13:31

score 0 · Answer 2 · answered Apr 06 '16 at 13:38

I fixed it by sending spree_api_key as a token param on the form.

    <%= form_tag(spree.api_ready_for_pickup_path(shipment), { method: "PUT", remote: true, id: "admin-ship-shipment" }) do %>
      <%= hidden_field_tag :token, try_spree_current_user.spree_api_key %>
      <%= submit_tag Spree.t(:ready_for_pickup), class: "ship-shipment-button" %>
    <% end %>

score 0 · Answer 3 · answered Oct 18 '21 at 10:19

It's working using token in params as you said, but in the documentation it's recommended passing it in headers like this :

Authorization: Bearer API_KEY

(of course, replace API_KEY by your own api key)

source : https://solidus.docs.stoplight.io/authentication

How do I avoid 401 (Unauthorized) when creating a new API endpoint for Solidus / Spree?

3 Answers3