API BasicAuth always return 403

Kirby 3 Solved ✅
1

I like to get data via API from the website. This is the content of my Plugin index.php:

<?php

Kirby::plugin('microman/immo', [
    'api' => [
        'allowInsecure' => true,
        'basicAuth' => true,
        'routes' => function ($kirby) {
            return [
                [
                'pattern' => 'location',
                'action'  => function () use ($kirby) {
                        return "Hello World";
                    }
                ]
            ];
        }
    ]
]);

I’ve created a user with following roles:

title: Visitor
permissions:
  access:
    panel: false

I’m using Postman with the BasicAuth function. I can’t get running this API. What’s wrong?

2

This should go in the config, I think.

3

Nope. That didn’t solve it.

4

I think you might have to allow Panel access (and disable all other views), otherwise the API doesn’t work at all. And set the other settings in the config.

5

It doesn’t work either:

title: Visitor
permissions:
  access:
    panel: true    
    site: false
    languages: false
    system: false
    users: false
6

Just tested your example and worked for me:

Plugin index.php

<?php
Kirby::plugin('microman/immo', [
    'api' => [

        'routes' => function ($kirby) {
            return [
                [
                'pattern' => 'location',
                'action'  => function () use ($kirby) {
                        return "Hello World";
                    }
                ]
            ];
        }
    ]
]);

config.php

return [
    'debug' => true,
    'api' => [
        'allowInsecure' => true,
        'basicAuth'       => true,
    ]
];

Visitor.yml

title: Visitor
permissions:
  access:
    panel: true
    site: false
    languages: false
    system: false
    users: false

Authenticate with visitor user

Bildschirmfoto 2022-03-04 um 17.23.38
Bildschirmfoto 2022-03-04 um 17.23.382062×528 40.9 KB

7

Error found: The allowInsecure and the basicAuth belongs into a api array. :man_facepalming:

8

It does actually also works with Panel permissions set to false!

title: Visitor
permissions:
  access:
    panel: false