I have created custom module and also implemented API in that but I want to know other two ways Auth base and Token base access.
My webapi.xml file:-

<?xml version="1.0"?>
<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"      xsi:noNamespaceSchemaLocation="../../../../../app/code/Magento/Webapi/etc/webapi.xsd">
<route url="/V1/brand/getList" method="GET">
    <service class="Ktpl\BrandManagement\Api\BrandRepositoryInterface" method="getList"/>
        <resource ref="anonymous"/>

I am able to get all the brand list but want to make this request more safer using auth and token base request.

2 Answers 2


In magento web-API when you pass user name and password then it genrates token for that specific customer (Which is only valid for 1 hour - configurable from admin)

http://magento.host/index.php/rest/V1/integration/customer/[email protected]&password=test@123

webapi.xml code

<route url="/V1/customers/me" method="GET">
    <service class="Magento\Customer\Api\CustomerRepositoryInterface" method="getById"/>
        <resource ref="self"/>
        <parameter name="customerId" force="true">%customer_id%</parameter>

which returns token.

After genrating token, when we pass that token in header.

Authorization :: Bearer <Token Value>


Which returns customer detailes.

The above case i explained is working fine for webAPI in magento2 which i tested in POSTMAN.

  • Where recovery customer data in method? Mar 17, 2021 at 17:46

You need to change this line:

<resource ref="anonymous"/>

Don't know your module, but you can create an ACL for this module and use it. Or you can just use another ACLs from other modules.

Search for the acl.xml inside etc folder.

The syntax is:

<resource ref="<vendorName>_<moduleName>::<keyACL>"/>

Well, all of this are defined on the acl.xml.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.