If you have read the authentication documentation page, you already know that Marketcloud provides three default authorization levels by default:

  • Public: Mostly read only operations that the average "guest" user can perform on your store, such as searching for products and handling shopping carts. Providing just the public key as authorization header will make your requests scoped within the public authorization level.
  • User: Your store's recurring users will want to review their orders, manage addresses and more. This authorization level provides a way to review and edit user-scoper information.
  • Admin: Superpowers, anything can be done. This is the default authorization level you get when authenticating with both public key and secret key. It's also the authorization level of the Dashboard. Remember, with great powers comes great responsibility!

It's all very simple, but what if you want to create a marketplace, where you have different kinds of users, some will be able to sell (e.g. to create products) and others just to buy? You certainly don't want to give them full admin access and you don't want to build another authorization layer on top of Marketcloud's. The answer is custom roles!

With custom roles you are able to create a Seller user role, so that users marked as Sellers can create products and edit and delete them.


Creating a new role

After we decided what this new kind of users should be able to do, we have to create our new Seller role. To do so, let's open our applications list and once selected our application, click on its settings button.

Now you should be in front of your app's overview, let's click on the Roles tab to load the roles view. If you never created a role, you should see an empty view.

Let's click on Add and create our Seller role. In the new view, at the top let's give our role a suitable name and select the User preset to make things faster. We chose the user preset because our Seller will have an authorization profile similar to a regular user except for products.

Now scroll down to the row for products authorization and let's check all the checkboxes to make sure our user can add edit and delete products.


Assigning roles to users

This can be done via API by updating a specific user:


// NodeJS example since to update a user's role you need admin authorization
// The role value must match the role name
client.users.update(user_id, {
  role : 'Seller' 
})

Or using the backoffice, visiting Customers > Click on a customer > Role :

Warning

After changing a user's role, that user might need to logout and login into your app to obtain its new authorizations.


This is just a very basic example of what can be done with roles, even though building marketplaces is the  most common application, you can really get fine grained control over your user's actions and create new user experiences for them.

Go ahead and choose your sdk among our collection and start building your marketplace right now! Remember to send me an invite for testing it :P !