mautic / mautic/api-library

No support for OAuth2 with `client_credentials`

Open
#332 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
205
Forks
129
PR merge metrics
No merged PRs in 30d

Description

So I tried both versions 3.1.0 and 4.0.0-beta, and it seems this library completely omits support for grantType with client_credentials, do I understand that correctly?

(PS. version 3.1.0 - there's a fatal error when doing a fresh composer install because of an interface mismatch with the psr package, so the current published version is unusable.)

So it seems, using OAuth2, this library is incapable of just doing a simple POST request to the server and capturing an access_token. It tries to redirect me between pages and asks me to log in as a user...?

I was trying to use this Mautic API Library to communicate between my web application and my self-hosted Mautic server, and so far I've spent 3 hours trying to get a basic connection going with OAuth2.

I've deep-dived through the code for generating an access_token, and it doesn't seem to make any sense, there's no mention of client_credentials anywhere in the OAuth code.

Here's some simple example code to test the OAuth2:

use Mautic\MauticApi;
use Mautic\Auth\ApiAuth;

$baseUrl = 'https://my-mautic-server.com';
$publicKey = '1234567890';
$secretKey = '1234567890';

$settings = [
    'baseUrl' => $baseUrl,
    'version' => 'OAuth2',
    'clientKey' => $publicKey,
    'clientSecret' => $secretKey,
    'grantType' => 'client_credentials',
];

$initAuth = new ApiAuth();

/** @var Mautic\Auth\OAuth $auth */
$auth = $initAuth->newAuth($settings);

if ( $auth->validateAccessToken(false) ) {
    //yay, it worked!
} else {
    throw new Exception('Failed to authenticate with Mautic API.');
}

$client = new MauticApi();
$segmentsApi = $client->newApi('segments', $auth, $baseUrl);
$results = $segmentsApi->getList();

var_dump("Results: ", $results);

The result is always a 401 unauthenticated:

{"errors":[{"code":401,"message":"The response has unexpected status code (401).\n\nResponse: {\"errors\":[{\"message\":\"API authorization denied.\",\"code\":401,\"type\":\"access_denied\"}]}"}]}

Using CURL in terminal, I'm able to generate an access token using client_credentials without any issues.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading ApiAuth, the OAuth authentication path returned by newAuth($settings), and validateAccessToken(false), using the provided client_credentials example as the reproduction case. Confirm the flow can obtain and use an access_token for the segments API without user redirects, and verify the 401 response is resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.