Drupal Services OAuth I have been working on this issue for a couple weeks now, and I can't find a solution for the life of me. The fact that I have found no decent documentation (on Drupal's website, or anywhere else) is no help either. And the questions already on here are outdated (Services 2.x).

I'm trying to create a REST service for a Drupal Commerce backed site. For now all the service must do is allow for basic CRUD operations on the Order resource, and be secured with OAuth, OAuth 2.0 isn't necessary. It must also be called with a script on a server, so login re-directs are impossible (everything is done with 2-legged authentication).

The current stack is:  


PHP 5.3.15   
Drupal 7.15   
Commerce Kickstart profile (7.x-2.0-rc1)  
Services 7.x-3.2
OAuth 7.x-3.0+18-dev   
OAuth Authentication 7.x-3.2  
REST Server 7.x-3.2   
Commerce Services 7.x-1.x-dev (This is the module I have added my custom Order code to)


I can kind of get the Retrieve/Index functions to work for Orders if I use an OAuth PHP library and just call the token request every time (I'm not even sure what's going on there, except that it authenticates...). If I try to POST to Orders and create an order though, I get 406 with the script, and 401 when I try a direct POST request from the REST Console in Google Chrome, even when OAuth is disabled. 

This has made debugging a nightmare since I have no idea what's going on inside my create function. I tried stripping it of its order creation logic and just echo back the request payload. Still get the 406/401 errors. 

I assume I get the 401 errors because orders require a user authentication (even if OAuth is turned off for the service).

I don't understand why I'm getting the 406 errors though. I accept application/json, which is what my REST server is set to return.

Orders were not being created even before I commented out the order creation logic. (Which I use elsewhere in the site effectively.)

Appreciation in advance.
-T
Get requests did not need session authentication, POST, PUT, DELETE require session authentication to know the user and check if he has right permissions to complete the request or not.

Oauth authentication have many types of auth you must ensure that you are authentication the user not the an app (for example) so the request is authorized to complete.