[Help Needed] vTiger CE & 3CX Integration – Custom Refresh Token Authentication Issue

[Qeis ITJ]

Hello everyone,

We are working on integrating vTiger Community Edition with 3CX (latest version) and need persistent authentication for contact lookup. Since OAuth is only available in vTiger Cloud, we have implemented a custom refresh token mechanism to authenticate 3CX without OAuth.

Our implementation is based on the discussion in this 3CX forum post, where the approach of using refreshToken and sessionName for authentication was suggested.


Implementation Details:


New API: Created refreshToken.php to accept a refresh token and generate a new sessionName.


Login Modification: Updated login.php to store refreshToken and access_token in the vtiger_api_tokens table after login.


3CX CRM Template Update: Configured 3CX to use refreshToken instead of OAuth.

Issue:

Calling refreshToken.php returns “AUTHENTICATION_REQUIRED”.


3CX fails to look up contacts, showing “INVALID_SESSIONID”.


Database check confirms that the refreshToken is stored correctly, but vTiger does not recognize it when used.

Expected Outcome:


refreshToken.php should generate a valid sessionName for API requests.


3CX should be able to fetch contacts using the refreshed session without requiring OAuth.

Has anyone encountered a similar issue or have any insights on why vTiger is not recognizing the refresh token? Any suggestions would be greatly appreciated!

Thanks in advance!

 

[edossantos_sipcaller]

This is a bit tricky. 3CX used to have an integration with this old API, but it was replaced in favor of the new API available in Vtiger cloud. I remember that the old authentication had an initial request to run a kind of challenge, and then get the session name, which had to be added to every request. I would try to find an old version of this template, maybe it's somewhere.... Or try contacting @ConceptsWeb for help.

 

[Qeis ITJ]

@edossantos_sipcaller Thank you very much


Hi @ConceptsWeb,

I hope you're doing well.

We are working on integrating vTiger Community Edition with 3CX (latest version) and need a way to achieve persistent authentication for contact lookup. Since OAuth is only available in vTiger Cloud, we have implemented a custom refresh token mechanism to authenticate 3CX without OAuth.

Our Approach:
New API: Created refreshToken.php to accept a refresh token and generate a new sessionName.
Login Modification: Updated login.php to store refreshToken and access_token in the vtiger_api_tokens table after login.
3CX CRM Template Update: Configured 3CX to use refreshToken instead of OAuth.

Issues Faced:
⚠ refreshToken.php returns "AUTHENTICATION_REQUIRED".
⚠ 3CX fails to look up contacts, showing "INVALID_SESSIONID".
⚠ Database check confirms that the refreshToken is stored correctly, but vTiger does not recognize it when used.

We received a suggestion (https://www.3cx.com/community/threa...om-refresh-token-authentication-issue.132458/) that older versions of the 3CX integration template used an initial challenge-response mechanism to obtain the sessionName. However, we couldn't find much documentation on this.

Since you have expertise in this area, could you please provide any guidance or point us to any references that might help? If you have insights on how vTiger's older API handled authentication in such cases, it would be really valuable.

 

[Evolute IT]

I'll check if we still have the old template somewhere. I think we do.

 

[Qeis ITJ]

I think we were working with the old template, which caused this issue. That's why we reached a point where we needed to create this new solution—I hope I'm wrong.

Link to the issue