The API documentation indicates that

/api/orders/current

should accept a guest token —

X-Spree-Order-Token

— for authorization, however that endpoint returns a 401 when using a guest token. I would expect it to return the guest order associated with that token, no?

What is the message you are getting in the response body? That might help you narrow the issue down https://github.com/solidusio/solidus/blob/master/api/app/controllers/spree/api/base_controller.rb#L53-L57

Using an order token for

/api/orders/current

doesn’t make much sense, you may just want to fetch the order that token belongs to

Right, I was hoping to get the guest order without using the order ID.

It seems like you are getting an authorization error, not an authentication error, so it may be that the order you are getting back doesn’t correspond to the token you are providing

That’s weird. Since the endpoint doesn’t take any order ID or number in the body, I was thinking that it would just return whatever current order is associated with that token. There’s no way to specify an order using that endpoint anyway.

Yeah, I feel like this came up recently in a discussion or an issue, but I can’t seem to find it now.

Probably why I should be asking on GH discussions rather than here, since Slack messages are ephemeral.

Looking at the controller, it looks like you are maybe getting an error from this before filter https://github.com/solidusio/solidus/blob/master/api/app/controllers/spree/api/base_controller.rb#L24

Right. And if you include an API token in the auth headers, then it looks up the order for the API user, not the guest.

I think this is worthwhile bringing up in an issue and if there is intention behind this we can convert to a discussion

Ok. I’ll make an issue and see what folks say. In the meantime, probably easier to reserve use of that endpoint for logged-in users. I’ll just store the order number in a cookie for guest users and hit

/api/orders/:number

rather than try to use the same endpoint for both — though it would be nice.

The whole body of this controller action is conditional on

current_api_user

so I agree with you 👍 https://github.com/solidusio/solidus/blob/master/api/app/controllers/spree/api/orders_controller.rb#L89-L93

I think we just fixed the api documentation on that endpoint, which should be available live on the next Solidus release.

Ahhh, so it’s working as expected then?

Thanks for digging this up @kennyadsl! I knew this came up recently but my search failed me 😂

All makes sense now. Thanks!