Is there a way to create a new order through API without an API key?

[forkata]

This recent issue reminded me of a case I encountered recently where we needed to generate a new guest order and add items to it. Since we don't have a logged-in user in that case, we don't have an API key with which we can call the create order API.

This is possible through the /orders/populate controller that spree_frontend provides and probably there is a way to do it with solidus_starter_frontend, but I am curious if there is a solution for doing this purely through the API?

[kennyadsl]

@forkata I think POST /orders is allowed even for non-authenticated users, see

solidus/api/spec/requests/spree/api/orders_spec.rb

Line 38 in aa3063e

post spree.api_orders_path, params: { order: attributes }

.

If that didn't work, it was maybe because of Spree::Api::Config.requires_authentication, which forces authentication on all endpoints?

[forkata]

Hey @kennyadsl, thank you for the response here! I did a quick test and I believe you are correct that the if that configuration is set there is no way to do this. For reference the authenticate_user filter in the API base controller will prevent the action from executing if Spree::Api::Config.requires_authentication is set to true.