Question About 3CX API Authentication and JWT Token Permissions

[patrickb_de]

I have a question regarding 3CX API authentication and the permissions assigned within the bearer token.

When I perform the login as officially documented via /connect/token, this does not work correctly for me from PHP, or it results in a token with very limited usability. If I instead use the same login flow as the web client, i.e. via /webclient/api/Login/GetAccessToken, I still only receive a token with user-level permissions.

This behavior occurs regardless of whether I log in with the admin account or a dedicated API user—both are defined as System Owner in the 3CX Management Console. API endpoints that require system-level permissions, such as /xapi/v1/Parameters, consistently return 403 Forbidden when called from PHP.

In contrast, access using PowerShell or Postman works flawlessly with the same user and provides full system_owner access to those exact endpoints. This strongly suggests that the issued token receives different claims or permissions depending on the login context (PHP vs. Web Client / Postman / PowerShell).

Therefore, my questions are:

• Is it by design that external clients such as PHP only receive user-level tokens, even when authenticating with valid System Owner users?
• If so, what is the reason for this restriction?
• If not, what is the official or recommended approach to obtain a fully system_owner-capable token when authenticating from PHP?

Thank you in advance for any clarification.

 

[Evolute IT]

We use PHP to talk to the API and we never had this issue.

Check if you have console restrictions enabled...

 

[patrickb_de]

I just tried to retrieve the token, and it works. However, when I inspect the Bearer token response (using a JWT debugger), the MaxRule is set to users.

If I use the token obtained from Postman or from the webclient, the MaxRule is set to system_owners.

I used same user or api credentials in webclient/postman and php

 

[Evolute IT]

I just tried to retrieve the token, and it works. However, when I inspect the JWT token response, the MaxRule is set to users.

If I use the token obtained from Postman or from the webclient, the MaxRule is set to system_owners.

Check console restrictions

 

[patrickb_de]

Both users - the API user and the system administrator - are assigned the system_owners role, and both work correctly in pman and powershell. Therefore, in my opinion, there are no restrictive console limitations.

Or which specific console restrictions did you mean?

 

[patrickb_de]

Okay, I need a moment to think about that and now its clear
ou mean the console restrictions for admin login from specific IP addresses? That could be the issue.

Let me give it a try.

 

[patrickb_de]

Check console restrictions

That’s it. Just add the web server’s IP address to the allowed IP addresses and everything works fine. Thanks! In Germany we sometimes say: "Sometimes you can’t see the forest for the trees.”