Session error while trying to use the API endpoints

[cansin]

Hi, this is a question.

We are trying to use DELETE https://payments.bigcommerce.com/api/v2/stores/{STORE_HASH}/shoppers/1/instruments/{INSTRUMENT_ID} endpoint, but we are hitting below error:

{
    "status": "error",
    "id": null,
    "avs_result": {
        "code": null,
        "message": null,
        "street_match": null,
        "postal_match": null
    },
    "cvv_result": {
        "code": null,
        "message": null
    },
    "three_ds_result": {
        "acs_url": null,
        "payer_auth_request": null,
        "merchant_data": null,
        "callback_url": null
    },
    "fraud_result": {
        "code": "none",
        "message": "Fraud service not available",
        "status": "ok"
    },
    "gateway_response": null,
    "transaction_type": null,
    "payment_result": "rejected",
    "fraud_review": null,
    "errors": [
        {
            "code": "unauthorized",
            "message": "Your session has expired. Please log in again."
        }
    ]
}

Now I think this has something to do with customer login as described at https://developer.bigcommerce.com/api-docs/storefront/customer-login-api . In fact we were able to login through the mechanism mentioned there. But trying any of the below did not result in a successful attempt on the payments API:

1. Passing the customer's JWT as Authorization: VAT {JWT},
2. Passing the customer's JWT as Authorization: PAT {JWT},
3. Passing the customer's JWT as Authorization: {JWT},
4. Manually passing the cookies set at https://storedomain.com to https://payments.bigcommerce.com
5. Passing the SHOP_SESSION_TOKEN cookie's value to https://payments.bigcommerce.com as Authorization: {Token}.

In short, I need some documentation around how we can login properly for a given customer. Can you advice?

[cansin]

For simpler reproduction, you can visit GET https://payments.bigcommerce.com/api/v2/stores/dvhhs2omlh/shoppers/1/instruments to see the error in question.

[cansin]

I was able to locate that we'd need to hit a /internalapi/v1/checkout/payments/vault-access-token API (per https://github.com/bigcommerce/checkout-sdk-js/blob/b218ccfb84d6ce85da2153deb50d08983ac56002/src/payment/instrument/instrument-request-sender.ts#L24 ), in order to get an access token, and then we could send it via Authorization: VAT {token}.

Though now hitting /internalapi/v1/checkout/payments/vault-access-token gives us an Authentication Required error. So I am trying to now figure out the proper mechanism to authenticate there. I have tried setting X-Auth-Client and X-Auth-Token but that did not work.