Webservice

Hi,

I'm trying to create a web service connection using the username, access key, and token, but I can't get it to return true; I always get this "INVALID_AUTH_TOKEN" error.

I've already tried:
MD5( token + accessKey )
MD5( accessKey + token )
MD5( token : accessKey )
MD5( token . ":" . accessKey )
and when I use this test in the browser: it gives an error.

https://MYCRM/webservice.p

By ChatGPT
---

The INVALID_AUTH_TOKEN error usually means you’re skipping (or invalidating) the challenge token step.

In Vtiger CRM Webservices, you cannot call operation=login with an arbitrary “token” you made up. You must:

1. Get a challenge token (valid for a short time)

text

GET https://MYCRM/webservice.php?operation=getchallenge&username=wpapi

2. Compute the accessKey hash exactly like this (no separators)

text

MD5( token + userAccessKey )

* No : / . / extra characters.
* userAccessKey is the Access Key shown in the user’s “My Preferences”.

3. Login (use the hash as accessKey)

text

POST https://MYCRM/webservice.php

operation=login

username=wpapi

accessKey=MD5(token + userAccessKey)

### Common gotchas that still cause INVALID_AUTH_TOKEN

* The challenge token expires quickly (often ~5 minutes). If you wait too long, you’ll get INVALID_AUTH_TOKEN.
* Calling getchallenge again (or from another process/tab) may invalidate the previous token for that user.
* Make sure the username is the same for both getchallenge and login.
* If getchallenge isn’t actually writing a token (DB issue), login will fail.

If you share your getchallenge response (mask the token) and the exact login request you send, it’s usually easy to spot the mismatch.