# Mautic API requires $\_SESSION running in order to generate tokens

**URL:** <https://forum.mautic.org/t/mautic-api-requires-session-running-in-order-to-generate-tokens/6070>\
**Category:** Development\
**Created:** [April 3, 2016, 5:55pm UTC](https://forum.mautic.org/t/mautic-api-requires-session-running-in-order-to-generate-tokens/6070 "2016-04-03T17:55:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tasselhof](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@tasselhof](https://forum.mautic.org/u/tasselhof)\
**Post date:** [April 3, 2016, 5:55pm UTC](https://forum.mautic.org/t/mautic-api-requires-session-running-in-order-to-generate-tokens/6070/1 "2016-04-03T17:55:22Z")

</div>

If you check my posts, you will realise, that I was facing very weird issues with Mautic API. Now I know hw I fixed all things, but lets begin soewhere. You all know the usual code to obtain the access token if you are using [Mautic API](https://github.com/mautic/api-library):

Code:

$settings = array( 'baseUrl' =\> '', // Base URL of the Mautic instance 'version' =\> 'OAuth2' // Version of the OAuth can be OAuth2 or OAuth1a. OAuth2 is the default value. 'clientKey' =\> '', // Client/Consumer key from Mautic 'clientSecret' =\> '', // Client/Consumer secret key from Mautic 'callback' =\> '' // Redirect URI/Callback URI for this script ); $auth = ApiAuth::initiate($settings);

if ($auth-\>validateAccessToken()) {  
//…

  
But, In my case the line **$auth-\>validateAccessToken()** was always throwing **false** to me no matter how dark magic was I using  
  
I was digging deep down in the API code to find out how the token is generated and on line 637 of **OAuth.php** I found this line:  

Code:

 $authUrl .= '?oauth\_token='.$\_SESSION['oauth']['token'];

  
So I tried to start the session:

Code:

session\_name("tasselhof"); session\_start(); $auth = ApiAuth::initiate($settings);

if ($auth-\>validateAccessToken()) {  
//…

  
And, **starting a session fixed all my problems**  
  
Therefore, I think I found a bug in mautic API, because I believe this should be done by API itself, so that the API has to programatically make sure that session is started before using $\_SESSION variable  
  
Should I start also github issue or is this enough information to provide a fix?

---

<div class="post-metadata">

**Author:** ![tasselhof](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@tasselhof](https://forum.mautic.org/u/tasselhof)\
**Post date:** [April 3, 2016, 5:55pm UTC](https://forum.mautic.org/t/mautic-api-requires-session-running-in-order-to-generate-tokens/6070/2 "2016-04-03T17:55:22Z")

</div>

If you check my posts, you will realise, that I was facing very weird issues with Mautic API. Now I know hw I fixed all things, but lets begin soewhere. You all know the usual code to obtain the access token if you are using [Mautic API](https://github.com/mautic/api-library):

```auto
$settings = array(
    'baseUrl' => '', // Base URL of the Mautic instance
    'version' => 'OAuth2' // Version of the OAuth can be OAuth2 or OAuth1a. OAuth2 is the default value.
    'clientKey' => '', // Client/Consumer key from Mautic
    'clientSecret' => '', // Client/Consumer secret key from Mautic
    'callback' => '' // Redirect URI/Callback URI for this script
);
$auth = ApiAuth::initiate($settings);

if ($auth->validateAccessToken()) {
//...
```

But, In my case the line $auth-\>validateAccessToken() was always throwing false to me no matter how dark magic was I using

I was digging deep down in the API code to find out how the token is generated and on line 637 of OAuth.php I found this line:

```auto
 $authUrl .= '?oauth_token='.$_SESSION['oauth']['token'];
```

So I tried to start the session:

```auto
session_name("tasselhof");
session_start();
$auth = ApiAuth::initiate($settings);

if ($auth->validateAccessToken()) {
//...
```

And, starting a session fixed all my problems

Therefore, I think I found a bug in mautic API, because I believe this should be done by API itself, so that the API has to programatically make sure that session is started before using $\_SESSION variable

Should I start also github issue or is this enough information to provide a fix?