Checking authenticated users via authorization cookies
Learn how to check which user is currently authenticated in your store using their authentication token and VTEX APIs.
In this guide, you will learn how to verify if a user is currently authenticated in your store using their authentication token stored in cookies. Additionally, you will learn how to retrieve identifying information, such as their user ID and email, using VTEX's API.
Authentication cookies overview
When a user logs into your store, cookies are created to store the authorization token. From that point onward, these cookies are automatically included in all requests to VTEX servers, enabling the system to identify the user performing the action.
In situations other than API requests to VTEX, you may need to check whether the user is logged in or retrieve identifying information, such as their email or user ID. These actions can also be accomplished using the authentication cookies.
Note that these cookies have the
HTTP OnlyandSecureoptions enabled. This means they cannot be accessed via JavaScript and will only be sent over secure HTTPS requests.
Instructions
Sending the request to verify user authentication
To check the authenticated user, send a request to the POST Check authenticated user endpoint, replacing the example account name, API key / token pair and user token.
Analyzing the API response
Authenticated user
If the user is authenticated, the API will return a JSON object with the following structure:
authStatus: The authentication status (e.g.,Success).id: The unique user ID within VTEX services.user: The user's email address.account: The account name associated with the request.audience: The audience scope of the token (e.g.,admin).tokenType: The type of token used for authentication (e.g.,user).
Sending the request to verify user authentication
To check the authenticated user, send a request to the POST Check authenticated user endpoint, replacing the example account name, API key / token pair and user token.
Analyzing the API response
Authenticated user
If the user is authenticated, the API will return a JSON object with the following structure:
authStatus: The authentication status (e.g.,Success).id: The unique user ID within VTEX services.user: The user's email address.account: The account name associated with the request.audience: The audience scope of the token (e.g.,admin).tokenType: The type of token used for authentication (e.g.,user).
Non-authenticated user
If the user is not authenticated, the HTTP status will be 401 (Unauthorized).