In this article:
Why we need access to your REST API
Our Magento 2 (Adobe Commerce) extension gives us access to your store's REST API. We use it to:
Create voucher codes and price rules. Most rewards are single-use voucher codes, which we create in your store when a customer claims a reward, or up front when you set the reward up.
Keep customers and orders in sync. Your store sends us new and updated customers and orders as they happen, and we check the API regularly to pick up anything that went missing on the way.
Read your store's configuration. When you install, and when you contact our Support team, we check the settings that affect your program, such as your websites, store views and installed modules.
Investigate problems. Your store holds the true record of your customers and orders, so we compare our data against it when something looks wrong.
Letting us through HTTP basic auth
If connecting LoyaltyLion to your store fails with an access error, the most common cause is HTTP basic auth on your server. Stores often use it to keep a site private during development, and our requests can't get past it.
Magento's REST API has its own authentication, so it is safe to remove the extra layer from your API routes, which start with /rest and /oauth on Magento 2. Here is an example .htaccess configuration that does that:
# set an environment variable "noauth" if the request starts with "/rest" or "/oauth"
SetEnvIf Request_URI ^/rest noauth=1
SetEnvIf Request_URI ^/oauth noauth=1
# the auth block
AuthName "Please login."
AuthGroupFile /dev/null
AuthType Basic
AuthUserFile /xxx/.htpasswd
# Here is where we allow/deny
Order Deny,Allow
Satisfy any
Deny from all
Require valid-user
Allow from env=noauth