Authorize Masterdata API call from react (admin) to node to masterdata

[sirev]

Hi Saito, this didn’t help, I still can call the API from the POSTMAN, and not from the vtex admin react app

[Saito]

Hello Sirev,

At this point I would change the endpoint to a public one or change it to a graphQL call.

[sirev]

Yeah, when setting public to true it is available to everyone, but you can control who can access it through policies using vrn resources, therefore setting the “access” attribute to authorized, so it’ll use VtexIdclientAutCookie, by the way we can use either VtexIdclientAutCookie or Authorization header, they both works, as I set both headers on masterdata too inside clients files (node side). I think it should be more explicitly described, maybe when I get some free time will make some PRs into vtex api docs…

The most strange thing is that I can’t use it in private mode using the same vrn resource, so my final resolution is:

"token": {
      "path": "/_v/token",
      "public": true,
      "access": "authorized",
      "policies": [
        {
          "effect": "allow",
          "actions": ["options", "get", "post", "delete"],
          "principals": [
            "vrn:apps:*:*:*:app/productleadpartnerro.productlead@*"
          ]
        }
      ]
    }

Useful references:
VRN - VTEX Resource Name (VRN)
Policies - Policies
Manifest - Manifest

[Saito]

Nice!

Never heard about the access option before. Thanks for sharing it.