Hi there! Few weeks ago in an IRC meeting Kyle told me that the REST API should also allow authentication from the CGISESSID. I told it is easy peezy. Had I known in what a mess the C4::Auth is... I didn't want to make things worse by duplicating somebodys already duplicated code, so I decided to take the hard way. I did my best in trying to bring all the real world problems we tackle in C4::Auth into modular and reusable authentication components we can use to authenticate different types of requests. I have to say it was really really difficult, but I think I have a pretty decent solution. (with PageObject integration tests to cover for regression) For my sanity, and yours, I ask you to take a peek at Bug 7174 and Bug 14540 to find some structure to the Koha's authentication mechanisms. There is a nice picture and a lot of text... and code, and tests. Take Care! Olli-Antti Kivilahti Järjestelmäkeittäjä vaarakirjastot.fi +358 50 449 7763 --Powered by Kubuntu Linux!