I want to implement custom ACL for my custom API. Can someone assist me how to achieve this.

Below is my webapi.xml file content:

<?xml version="1.0"?>
<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Webapi:etc/webapi.xsd">

    <route url="/V1/mymethod/show/:num1/:num2" method="GET">
        <service class="MyNamespace\CoreApi\Api\CoreApiInterface" method="show"/>
            <resource ref="self"/>


Now instead of <resource ref="self"/> or <resource ref="anonymous"/>, is there any alternative available which is depends on my custom authentication rather than Magento.

The reason behind this is right now I'm build up custom API in which all of my frontend customer having a unique key say API key (We planned to develop this as well). And using this API key they will able to communicate with my custom API. And according to my requirements, I guess creating consumer key and secret through Magento admin (System > Extensions > Integrations) is not to be the advisable solution.

Is there any possibility to do so with Magento 2?

  • It is confusing what you are trying to achieve. Specially the part where you say you do not want to use Magento admin. Do you want the users to create their own account and have permissions to your Module?
    – awavi
    Mar 26, 2016 at 14:19
  • Hello, Jayesh did you managed to solve this problem ? I have exactly one, did you got way to authentication customer with via you module?
    – Ilja
    Nov 9, 2016 at 15:37
  • No, unfortunate I switch to other framework to achieve my goal. Nov 10, 2016 at 6:53
  • Looking for similar magento.stackexchange.com/questions/294426/…
    – Ajwad Syed
    Nov 4, 2019 at 6:47

2 Answers 2


I'm a bit of confusion, but you can try this

create acl.xml and put some rules, then next, edit your webapi.xml to

something like this:

<route url="/V1/mymethod/show/:num1/:num2" method="GET">
    <service class="MyNamespace\CoreApi\Api\CoreApiInterface" method="show"/>
        <resource ref="[module name]::[acl rule id]"/>

Check the example in Magento


<route url="/V1/order/:orderId/ship" method="POST">
        <service class="Magento\Sales\Api\ShipOrderInterface" method="execute"/>
            <resource ref="Magento_Sales::sales" />

Similarly you can use your own module ACL

  • why down voted ? Feb 7, 2019 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.