REST API GET Collection via API-Key | Payload | Page 1

nova trellis Apr 6, 2023, 12:35 PM

#

Hi together,

we want to use Payloadcms as a headless cms for our 11ty based webpage. So before building the page, I need to get the posts from our cms.

As I don't want to perform a login every time, I want to use the useAPIKey functionality.

Imagine you have a collection "news" which is the one I want to get my page content from.

As the docs said, I added the following code block to my collection config

auth: {
    useAPIKey: true,
  },

https://payloadcms.com/docs/authentication/config#api-keys

But when I now refresh my page, I got also a field "E-Mail" and I need an API-Key per User.

Also when trying to use the generated key, I got the error "You are not allowed to perform this action."

Yes, added "Authorization" to my GET request header COLLECTION-SLUG API-Key KEYSTRING

Can you please help me?

Payload CMS

Authentication Config | Documentation | Payload CMS

Enable and customize options in the Authentication config for features including Forgot Password, Login Attempts, API key usage and more.

sharp geyser Apr 6, 2023, 12:47 PM

#

Hello @nova trellis, maybe I can help

#

So you want to use the api key per-user functionality, right?

nova trellis Apr 6, 2023, 12:47 PM

#

sharp geyser So you want to use the api key per-user functionality, right?

yes, this is my first problem 😄

sharp geyser Apr 6, 2023, 12:48 PM

#

Is there an issue with enabling that feature?

#

I dont understand this part But when I now refresh my page, I got also a field "E-Mail" and I need an API-Key per User.

nova trellis Apr 6, 2023, 12:50 PM

#

Yes, I'm not sure how/where to enable the api-key per user.
If I add it to my (for example "news") "content" collection, I have the same API key for each user.
If I add it to the "User" collection I have a key per user but cannot access my content collection with this API key 🙈

sharp geyser Apr 6, 2023, 12:50 PM

#

The api keys are generated per-use i believe in the collection

#

To enable API keys on a collection, set the useAPIKey auth option to true. From there, a new interface will appear in the Admin panel for each document within the collection that allows you to generate an API key for each user in the Collection.

#

The second sentence

#

Any luck with that?

nova trellis Apr 6, 2023, 12:52 PM

#

sharp geyser The second sentence

Ok, seems to be correct

#

But I have the field "E-Mail" above 🤔

sharp geyser Apr 6, 2023, 12:53 PM

#

Ooo nice, that is what you wanted right?

nova trellis Apr 6, 2023, 12:53 PM

#

Yes, I now have an api key per user but why do have this E-Mail field?

#

And second part is, that I cannot authenticate using the API-Key when trying to perform a request e.g. using ThunderClient

nova trellis Apr 6, 2023, 12:56 PM

#

sharp geyser Ooo nice, that is what you wanted right?

okay. sorry. I re-checked it and saw, that the same API-Key is display for two users as I told before

sharp geyser Apr 6, 2023, 12:57 PM

#

Can I see the collection code?

nova trellis Apr 6, 2023, 12:59 PM

#

const TestCollection: CollectionConfig = {
  slug: 'testcollection',
  labels: {
    singular: '"Testcollection"-Entry',
    plural: 'Testcollection-Entries'
  },
  auth: {
    useAPIKey: true,
  },
  admin: {
    useAsTitle: 'title',
    defaultColumns: [
      'title',
      'category',
      'publishDate'
    ],
    group: 'Content',
    listSearchableFields: [
      'title',
      'category',
    ],
    disableDuplicate: true,
  },
  access: {
    create: hasCreateAccessToPosts,
    read: hasReadAccessToPosts,
    update: hasUpdateDeleteAccessToPosts,
    delete: hasUpdateDeleteAccessToPosts,
  },
  versions: {
    drafts: true,
  },

sharp geyser Apr 6, 2023, 1:06 PM

#

hmm

#

and in the photo you posted, that is of this collection?

#

(sorry, im english hehe)

nova trellis Apr 6, 2023, 1:09 PM

#

Yes, this is correct.
I just renamed it within the example code. But functionality is the same.

#

I cutted before starting with "fields"

sharp geyser Apr 6, 2023, 1:11 PM

#

My guess is that because you have API key enabled for the collection ,it also shows the user email the key is generated for

#

If you remove API key from the collection config, does it go away?

nova trellis Apr 6, 2023, 1:14 PM

#

Yep. As I remove the block "auth" from my config file for the content collection, E-Mail and "API-Key" will be removed from the frontend.
But which API-Key should I use instead? 🤔

nova trellis Apr 6, 2023, 1:15 PM

#

sharp geyser My guess is that because you have API key enabled for the collection ,it also sh...

I also think so. But why is the E-Mail the same when I sign in with another user?

sharp geyser Apr 6, 2023, 1:15 PM

#

Hmm it should not be

#

How are your users logging in?

nova trellis Apr 6, 2023, 1:19 PM

#

Currently using E-Mail and password.

sharp geyser Apr 6, 2023, 1:21 PM

#

Through the front end or directly into the Payload control panel?

nova trellis Apr 6, 2023, 1:22 PM

#

directly into payload control panel

sharp geyser Apr 6, 2023, 1:23 PM

#

And how are you using the api keys then?

nova trellis Apr 6, 2023, 1:24 PM

#

I want to use the api keys to fetch the content for our webpage using 11ty Fetch

sharp geyser Apr 6, 2023, 1:26 PM

#

Ah okay, I didn't know if you had a setup where you created a login form on your frontend, sent a login request which would generate a cookie the user could authorize with

#

Lets try basic

#

Can you make a new collection, "Books", with only one field

#

and enable API key on it

#

Lets make a simple test case to get to the bottom of this

nova trellis Apr 6, 2023, 1:29 PM

#

ok. give me a second 😄

nova trellis Apr 6, 2023, 1:30 PM

#

sharp geyser Ah okay, I didn't know if you had a setup where you created a login form on your...

No, as this will be just a programmatically based request without a login form I cannot use a cookie. I'd have to call /login, get the jwt and then do a request

sharp geyser Apr 6, 2023, 1:31 PM

#

Take your time

nova trellis Apr 6, 2023, 1:34 PM

#

ok. I added the collection "books".

sharp geyser Apr 6, 2023, 1:34 PM

#

Nice nice

nova trellis Apr 6, 2023, 1:34 PM

#

import { CollectionConfig } from 'payload/types';

// Example Collection - For reference only, this must be added to payload.config.ts to be used.
const Books: CollectionConfig = {
  slug: 'books',
  auth: {
    useAPIKey: true,
  },
  admin: {
    useAsTitle: 'title',
    defaultColumns: [
      'title',
    ],
    group: 'Content',
    listSearchableFields: [
      'title',
    ],
    disableDuplicate: true,
  },
  versions: {
    drafts: true,
  },
  fields: [
    {
      name: 'title',
      type: 'text',
      required: true,
      unique: true,
      label: 'Titel',
    },
  ],
}

export default Books;

sharp geyser Apr 6, 2023, 1:35 PM

#

OK looks good, we got a title field

nova trellis Apr 6, 2023, 1:35 PM

#

But when I want to create an entry, I also have to provide a username. 🤔

#

#

sharp geyser Apr 6, 2023, 1:36 PM

#

this seems odd

#

@harsh badger Sorry, this also seems odd, any idea why it's asking for user creds on this collection?

#

@nova trellis Until they can reply, I'm looking into it as well

nova trellis Apr 6, 2023, 1:38 PM

#

@sharp geyser thanks 😄

#

If I add "useAPIKey" to users and try to perform a request to /api/users using ThunderClient and the API-Key I got from the account page, this works. But as you see, it won't work for other collections 🙈

harsh badger Apr 6, 2023, 1:41 PM

#

by default, enabling auth also enables the local authentication strategy (email / password)

#

BUT

#

you can disable the local auth strategy, while keeping the api key strategy

#

but how come you are enabling auth on a "books" collection?

#

generally when we do this we make a collection called "API Keys" and then just enable auth on that collection

surreal vector Apr 6, 2023, 1:46 PM

#

nova trellis No, as this will be just a programmatically based request without a login form I...

@nova trellis maybe this might help? https://discord.com/channels/967097582721572934/1093168403147141181

sharp geyser Apr 6, 2023, 1:47 PM

#

harsh badger but how come you are enabling auth on a "books" collection?

I recommended making a basic books collection to try to isolate the issue

nova trellis Apr 6, 2023, 1:48 PM

#

Give me just a second, I'll try something

harsh badger Apr 6, 2023, 1:53 PM

#

sorry in classic form i am writing a blog post the day of it needing to be released, multitasking. I missed the books convo above

nova trellis Apr 6, 2023, 1:53 PM

#

@sharp geyser @surreal vector @harsh badger thank you for your fast help 😄
While testing this, I figured out, that I can use "useAPIKey" on my "users" collection. Then I can query the api, e.g. for books with the header
Authorization: users API-Key KEYSTRING

harsh badger Apr 6, 2023, 1:53 PM

#

but yea I'd make an API Keys collection

#

or yes that

nova trellis Apr 6, 2023, 1:54 PM

#

The docs made me a bit confused 😅 so I thought that I have to enable "useAPIKey" within the auth-block for my content-collection (e.g. books)

harsh badger Apr 6, 2023, 1:59 PM

#

nope, api keys authenticate you as the user that the api key is tied to

#

they are not free-for-all, they respect the permissions and access that the user has

#

which is f-ing beautiful

sharp geyser Apr 6, 2023, 2:00 PM

#

That is super nice!

#

😄

#

Glad you got it going @nova trellis !!

nova trellis Apr 6, 2023, 2:03 PM

#

harsh badger they are not free-for-all, they respect the permissions and access that the user...

Yes, this is a very good feature 👏
But you need to understand it 😉

harsh badger Apr 6, 2023, 2:04 PM

#

yeah we could put more in our docs about it for sure

#

what's the saying

#

with great power comes great responsibility

#

damn i am a loser

#

and what's really special is that this whole thread will be indexed on our website forever

#

🤦‍♂️

surreal vector Apr 6, 2023, 2:05 PM

#

I think adding a "recipes" section for the docs would be 💣

#

payloadcms.com/docs/cookbook

nova trellis Apr 6, 2023, 2:06 PM

#

In Germany we got a proverb for this thread "You grow with your challenges" 😁
So sometimes you'll learn more while "trial and error" than while reading the docs 😉

surreal vector Apr 6, 2023, 2:06 PM

#

Love how Kirby did it: https://getkirby.com/docs/cookbook

Kirby CMS

Cookbook

Delicious recipes and solutions for common tasks.

nova trellis Apr 6, 2023, 2:07 PM

#

If you want to, just give me a note when the cookbook is ready and then I'd write the recipe 😉

#REST API GET Collection via API-Key