How to authenticate admin-api from another app.

[eduarddotgg]

I would like to connect to the admin api from another app which won't have any sign-in functionality for admin api. Is there any way to use just an api token from another server? What is the best way to do this?

[michaelbromley]

Hi,
There's no built-in functionality to allow access to restricted API operations with just an API token. What I normally do for machine-to-machine API calls is to create a Role + Administrator for the client app, and then execute the login mutation from the app, save the returned bearer token, and attach it to all subsequent calls.

Yes, this is exactly the login flow used by human admins too. You said your app won't have such functionality but I just though it's worth mentioning that it's totally possible without human intervention.

If you cannot do this, then another option is to create custom queries/mutations specifically for this app to use, and do not restrict them with the @Allow() decorator, and instead use some logic internally in the resolver function to check the presence of some API token that you have defined.

[eduarddotgg]

Thanks for your quick reply!
Yes, one of the ideas was to implement login on the backend side (machine to machine).
And how do you think is there any way to automate this, maybe some custom auth strategy?

[michaelbromley]

Do you mean to automate the creation of a Role & Administrator for the machine user? Yes, a custom auth strategy could handle this, since it can run any arbitrary logic in its handler.

[eduarddotgg]

As far as i understood with auth strategy i will have to call authentication query to authenticate user, erc. But is there any way to do something similar to what passport.js does:

app.post('/profile', passport.authenticate('jwt', { session: false }),
    function(req, res) {
        res.send(req.user.profile);
    }
);

some custom middleware that will validate auth token.

[eduarddotgg]

but at the same time native auth should remain.

[michaelbromley]

As far as i understood with auth strategy i will have to call authentication query to authenticate user, erc.

Yes that's true - you'd still need that initial authenticate mutation before doing the actual work.

It might be possible to implement something like you suggest - you can supply middleware in your VendureConfig.