Seller API

The plugin ships an API Platform resource set for the seller panel (vendor, seller users, vendor orders, payout methods, ...), alongside Sylius' own admin/shop APIs. Two things need to be wired into your application: the routes, and a dedicated firewall for the seller API user.

1. Import the routes

# config/routes.yaml
odiseo_marketplace_api:
    resource: "@OdiseoSyliusMarketplacePlugin/config/routing/api.yaml"

This exposes the seller API resources under /api/v2/seller and a token endpoint at /api/v2/seller/authentication-token.

2. Add a firewall for the seller API user

The seller API uses its own JWT firewall, the same way Sylius' own admin/shop APIs do:

# config/packages/security.yaml
parameters:
    odiseo_marketplace.security.api_seller_route: "%sylius.security.api_route%/seller"
    odiseo_marketplace.security.api_seller_regex: "^%odiseo_marketplace.security.api_seller_route%"

security:
    providers:
        odiseo_marketplace_api_seller_user_provider:
            id: odiseo_marketplace.security.seller_user_provider

    firewalls:
        # ...
        api_seller:
            pattern: "%odiseo_marketplace.security.api_seller_regex%/.*"
            provider: odiseo_marketplace_api_seller_user_provider
            stateless: true
            entry_point: jwt
            json_login:
                check_path: "%odiseo_marketplace.security.api_seller_route%/authentication-token"
                username_path: email
                password_path: password
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
            jwt: true

    access_control:
        # ...
        - { path: "%odiseo_marketplace.security.api_seller_route%/authentication-token", role: PUBLIC_ACCESS }
        - { path: "%odiseo_marketplace.security.api_seller_regex%/.*", role: ROLE_API_ACCESS }

Make sure the api_seller firewall is declared before any catch-all %sylius.security.api_regex% firewall in your security.yaml, the same way Sylius orders api_admin/api_shop before the rest.

A seller user then authenticates the same way a shop or admin user does: POST their email/ password to the authentication-token endpoint above to get a JWT, then send it as a Bearer token on subsequent requests to /api/v2/seller/....