REST API POST: User is not authorized despite being admin

Question

I'm working on a quick script as a proof of concept to POST content to my Drupal instance using the REST API.

The user I'm trying to post as is an Administrator, but I get an error that they don't have permission to create the Content.

Here's the simple script I'm using so far (removed a lot of debug and extra code for brevity). It gets a CSRF token, constructs the JSON body and POST's the request to the REST endpoint to create a piece of content of the game type.

<?php

$autoloader = require_once __DIR__ . '/../../vendor/autoload.php';
use GuzzleHttp\Client;

$client = new Client([ 'base_uri' => $url ]);

$csrfResponse = $client->request('GET', '/rest/session/token');
$csrfToken = trim($csrfResponse->getBody());

$jsonPayload = [
    'type' => 'game',
    'title' => [[ 'value' => 'Test Game ' . strtotime('now') ]],
];

$postResponse = $client->request('POST', '/entity/node?_format=json', [
    'auth' => [$user, $password],
    'body' => json_encode($jsonPayload),
    'headers' => [
        'Content-Type' => 'application/json',
        'X-CSRF-Token' => $csrfToken
    ]
]);

debug("Status Code: " . $postResponse->getStatusCode());
debug($postResponse->getBody());

Problem: I get 403 Forbidden response telling me:

{"message":"You are not authorized to create this node entity of bundle game."}

This despite the fact that the user is an Admin (and I even tried giving them explicit permission to Create and Review contents of the Game type). I get the same error if I put in a bogus username and password as well.

The answers suggested in the related question about "403 Forbidden when creating a page with RESTful API" did not work for me.

Answer 1

My problem was that the Basic Auth module was not enabled. I only found that out by chance as I was scrolling through the enabled modules, as the error message above didn't indicate how authentication was being done.