JWT on Woocommerce cannot work with "Customer" role user

Question

I developing mobile apps, that connect directly to woocommerce rest api. I use this plugin for authenticating, like registering, login, make an order, etc.

So the issue come, when I register new user (with default role is Customer), I try to make an order : http://123.456.789.910/lili_shop/wp-json/wc/v3/orders , it says :

{
    "code": "woocommerce_rest_cannot_view",
    "message": "Sorry, you cannot list resources.",
    "data": {
        "status": 403
    }
}

Then I change user role of registered user to "Administrator", it works.

But, what I want is, a new registered user (with default role is Customer) can consume woocommerce API with JWT too, how can I achieve this?

Anyhelp will appreciate.

Thanks.

Answer 1

Not sure if you are still looking for a solution but I ran into a similar issue where I was not able to even retrieve the product listing from a customer account. There were a few things I realized when doing it:

1. Since administrator had access it had to be a security issue.
2. I installed a user role editor and added some of the extra privileges to see if it would work. (I was testing just the product listing and categories at the time). Note: You can only use read access for the roles in particular if security is an issue.
3. This worked and I was able to retrieve the listing for the products and the categories.

I am still looking for a solution to the orders but it definitely involves doing something with security (will edit this post if I do find one). My instinct tells me that JWT Token used in woocommerce checks if the user even have access to edit the information.

It is definitely not an issue with the JWT token but something on woocmmerce side. See this post for details: https://github.com/woocommerce/woocommerce/issues/17983 Hope this helps.