How to obtain GraphQL access token on local XM Cloud

Question

I want to use the GraphQL playground on my local instance of XM Cloud. The URL is https://xmcloudcm.localhost/sitecore/api/authoring/graphql/ide/.

My understanding is that in order for this to work, the playground must be enabled, and an access token must be generated.

I added Sitecore_GraphQL_ExposePlayground: "true" to my docker-compose.override.yml to enable the playground and I can load the GraphQL Playground in my browser but without the access token, no queries will work.

This guide (Walkthrough: Enabling and authorizing requests to the Authoring and Management API) provides the instructions for how to get a token, but I haven't been successful in getting it to work.

I always get some variation of

{
    "error": "access_denied",
    "error_description": "Unauthorized"
}

Error while getting client credentials token: Unauthorized

Working through the replacements that the guide mentions:

• <authority-url>: endpoints.xmCloud.authority value from the .sitecore/user.json file.

  • In my case this value is https://auth.sitecorecloud.io/

• <your-client-id>: endpoints.xmCloud.clientId value from the .sitecore/user.json file.

  • In my case this value is Chixxxxxxxxxxxxxxv7

• <your-client-secret>: endpoints.xmCloud.clientSecret value from the .sitecore/user.json file.

  • My .user.json file contains no such key or value, so I used a client secret value that I found in the .env file that was generated for me: SITECORE_FedAuth_dot_Auth0_dot_ClientSecret=xjQlxxxxxxxxxxxxx-3j-vxxxxxxxxxQ

Where am I going wrong here?

Answer 1

Couple of things here, There are two types of API

1) Preview API - Which what you are referring to which has a URL https://xmcloudcm.localhost/sitecore/api/authoring/graphql/ide for this to work, you will have to pass sc_apikey header parameter with the value of the API key (ITEM GUID) you created inside your sitecore instance on the path /system/settings/services/api keys/<your api key item>

2) Delivery API - Which has a universal URL https://edge.sitecorecloud.io//api/graphql/ide with the end point https://edge.sitecorecloud.io/api/graphql/v1 which can query for your published content on experience edge

as in your case you want to use a preview URL, you are not passing any header values, and { "authorization":"Bearer token" } is not the right syntax, maybe you got confused in the documentation, to get the API key you might need to get JWT token and from it, you get the API key, but here for preview API, it's just the item of your Sitecore under the path I mentioned, you pass GUID like below in header

And the below switch is for administration API like management and authoring API, so it should only be enabled if you want to CREATE/DELETE items from graphQL but I think you only want to fetch so turn this OFF

Sitecore_GraphQL_ExposePlayground: "true"

Answer 2

If you want to use the GraphQL playground on your local instance of XM Cloud there are Preview And Delivery API in XMC

API - Preview API

Preview — Can be used for self-hosted CM instance for testing purpose before publishing anything

IDE: https://<your cm host>/sitecore/api/authoring/graphql/ide/ (Browser URL)

Endpoint: https://<your cm host>>/sitecore/api/authoring/graphql/v1

API — Delivery API Delivery — Used when you have tested and approved content and published it. IDE: https://edge.sitecorecloud.io/api/graphql/ide (browser URL) Endpoint: https://edge.sitecorecloud.io//api/graphql/v1 To access delivery api you need a access token. So there are multiple approach's to get access token. I will explain step by step here.

Approach-1

Get Access Token Run the below commands inside the same folder when you installed CLI for your project.

1. dotnet sitecore cloud login

NOTE: Fire these command from command prompt and not PowerShell or Postman

2. Run the below command to get the access token.

   dotnet sitecore cloud login --client-credentials --client-id <your-client-id> --client-secret <your-client-secret> --allow-write true --xmcloudhost <your-xmcloud-host> --authority <authority-url> --audience <audience-url>

Replace your values as per below table.

<your-xmcloud-host> Your XMC URL
<authority-url> https://auth.sitecorecloud.io
<audience-url> https://api.sitecorecloud.io
<your-client-id> Client Id from previous step
<your-client-secret> Client Secret from previous step

3. Request bearer token using below command. Replace the values.

   curl --request POST --url "https://auth.sitecorecloud.io/oauth/token" --header "content-type: application/x-www-form-urlencoded" --data audience=https://api.sitecorecloud.io --data grant_type=client_credentials --data client_id=<REPLACE WITH YOUR CLIENT ID> --data client_secret=<REPLACE WITH YOUR SECRET>

To get the token, let’s execute the curl command as mentioned above after replacing your client id and client secret in the last step.

To quickly execute curl command, i used this very useful application https://reqbin.com/curl

Copy the access_token from response and let's continue to verify the access token using GraphQL IDE.

Open the GraphQL IDE with the instance url post fixed with /sitecore/api/authoring/graphql/ide/

This will look like below url

https://instance-url/sitecore/api/authoring/graphql/ide/

add the authorization parameter in the header along with the access token we got from curl query execution in our last step.

{ 
   "Authorization": "Bearer PASTE-YOUR-ACCESS-TOKEN-HERE"
} 

If everything goes well, you should be able to get response back as depicted bellow GraphQL IDE image.

That’s All, Now the GraphQL is setup for Authoring and Management.

Answer 3

Do let me know if you are still facing issues, it seems there are changes you will need to do if you want to use authoring APIs

First of all the browser should have the following URL

https://<<Your cm host>>/sitecore/api/authoring/graphql/ide/

If you get document not found, you will have to turn on graph QL playground, but I can see you already are able to open the IDE so that is sorted

Now when you hit the above URL in a browser, it opens up IDE with the wrong URL, change that URL to the following and hit enter (not in the browser URL but in the IDE right-hand side of the history tab)

https://<<your cm host>>/sitecore/api/authoring/graphql/v1/

NOTE: that SLASH at the end is important too, and by default, IDE generates the wrong URL

Now, you will need to authorize the IDE so it can make calls, and for it you will need to use client id and secret from XM Cloud "Automation Clent" option, it will create ClientId, and Secret for you

Now use them in following command first

dotnet sitecore cloud login --client-credentials --client-id <your-client-id> --client-secret <your-client-secret> --allow-write true --xmcloudhost <your-xmcloud-host> --authority <authority-url> --audience <audience-url>

upon successful login, fire the below command

curl --location --request POST '<authority-url>/oauth/token' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'client_id=<your-client-id>' --data-urlencode 'client_secret=<your-client-secret>' --data-urlencode 'audience=<audience-url>' --data-urlencode 'grant_type=client_credentials'

Now you will get a token, pass this token as following in header

{
  "Authorization":"Bearer <<token you got above>>"
}

I have mentioned all the steps on https://daivagnananavati.blogspot.com/2023/04/xm-cloud-10-steps-of-graphql-mutations.html see if it helps

Answer 4

On your local CM and the preview end point on your XM Cloud CM, you use the guid of your /system/settings/services/api keys/<your api key item> as the api key. If you look in your .env file you should see the value.