Authenticate user by API Key on custom endpoints | Payload | Page 1

sullen frost Dec 8, 2022, 5:42 AM

#

I have created some custom endpoints but they are unprotected by default. How can I use Payload auth or user API keys to protect them?

I have gone through the following but they don't cover a custom endpoint case:
https://payloadcms.com/docs/authentication/config#doc <-- only Collection based, not custom endpoint.

https://payloadcms.com/docs/authentication/overview#token-based-auth <-- covers how to authenticate using JWT token, not API Key.

I have custom endpoints both on App level and Collection level. Neither seem to play nice with Payload authenticate middlewares when using API Keys.

visual pelican Dec 8, 2022, 7:45 AM

#

You can use middleware:
https://payloadcms.com/docs/authentication/using-middleware

Payload CMS

Using the Payload Auth Middleware | Documentation | Payload CMS

Make full use of Payload's built-in authentication with your own custom Express endpoints by adding Payload's authentication middleware.

sullen frost Dec 8, 2022, 7:53 AM

#

I tried using middleware as in the examples, but putting API Key in the Authorization header as shown will not produce Payload to inject User object into the http request.

visual pelican Dec 8, 2022, 8:05 AM

#

you can get the user directly from mongodb

#

create your own middleware to do this

sullen frost Dec 8, 2022, 8:43 AM

#

Using the API Key? In this case, is it known what hashing algorithm Payload uses for Api keys?

visual pelican Dec 8, 2022, 12:36 PM

#

did you are using the API Key generated by admin panel, or jwt token?

summer ocean Dec 8, 2022, 2:48 PM

#

It is only the custom endpoints that are missing the req.user?
custom endpoints should hit the same middleware unless you have the root: true added and that is only an option outside of collections.

I would verify that your requests work for the built-in collection endpoints to rule out that it is in fact an issue with the custom endpoints if you haven't already.

You shouldn't have to write your own middleware. At worst you can import Payload's middleware but since that should already be running before your endpoint handler gets called, that won't fix your problem anyways.

#

One common mistake with the authorization header is that payload recognizes:
"Authorization: "JWT {token}" and not "Authorization: "bearer {token}"

#

You can diagnose by comparing the admin UI requests in the network tab with how your app is calling Payload to find differences.
@sullen frost I hope some of this will help.

hasty whale Dec 8, 2022, 3:28 PM

#

in addition, to authenticate via API key, here are the docs:

#

https://payloadcms.com/docs/authentication/config#api-keys

Payload CMS

Authentication Config | Documentation | Payload CMS

Enable and customize options in the Authentication config for features including Forgot Password, Login Attempts, API key usage and more.

#

need a header like this:

#

Authorization: MyCollectionSingularLabel API-Key 4iwj34li43jltij4

sullen frost Dec 9, 2022, 2:42 AM

#

This does not work on custom endpoints. Adding the API-Key to the headers does not attach User object to HTTP request object on custom endpoints. At least that is my experience. Should it ?

sullen frost Dec 9, 2022, 2:43 AM

#

summer ocean It is only the custom endpoints that are missing the `req.user`? custom endpoin...

I am using the API Key not the token

summer ocean Dec 9, 2022, 2:45 AM

#

Yeah that is supposed to work. Do you want to create an issue on GitHub? I'd like to dig into this tomorrow.

sullen frost Dec 9, 2022, 2:46 AM

#

Noted, will triple check this today before posting. Thank you.

summer ocean Dec 9, 2022, 2:47 AM

#

Nice, let me know. Happy to help

sullen frost Dec 9, 2022, 2:48 AM

#

Perhaps the issue is with version. What is the latest stable Payload version?

summer ocean Dec 9, 2022, 2:48 AM

#

1.2.5

#

I'm not aware of any recent changes on this though

sullen frost Dec 9, 2022, 2:48 AM

#

Also as a note, my Collection does not have any auth params defined.

#

Yes just tested again.
Collection (non auth)

    {
      path: '/testing',
      method: 'post',
      handler: [
        async (req, res, next) => {
          console.log("/testing | user: ", req.user)
          if (req.user) next()
          else res.status(401).send({ error: "unauthorized" });
        }
      ]
    }

Request

http://localhost:3000/api/assets/testing
Headers: Authorization: Asset API-Key <USER_API_KEY>

#

req.user is undefined.

summer ocean Dec 9, 2022, 2:54 AM

#

Wait, what collection are you using for auth? in headers it looks like Asset instead of your users collection

sullen frost Dec 9, 2022, 2:56 AM

#

I am requesting Assets not User.
Flow:

Create new user (enable API key) - this is a "system service" user.
Create new collection "Assets"
Put User API key to 3rd party service (Moralis)
Have Moralis call Payload on the behalf of the user (using his API keys) to interact with Assets collection.

summer ocean Dec 9, 2022, 2:58 AM

#

Your flow makes sense, but that header needs to tell Payload what user collection the the API key belongs to, not what you're trying to query.

sullen frost Dec 9, 2022, 2:59 AM

#

it works now, I'm stupid.

summer ocean Dec 9, 2022, 2:59 AM

#

Hahaha, no worries. Your not stupid

sullen frost Dec 9, 2022, 2:59 AM

#

Thank for the help again 🙂

summer ocean Dec 9, 2022, 3:00 AM

#

Very welcome!

hasty whale Dec 9, 2022, 1:47 PM

#

i love it when things work out

#

haha

#Authenticate user by API Key on custom endpoints