As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html
By default magento 2 only restrict Catalog, Store and CMS API from anonymous users.

In a same way how I can restrict access for all the available API's in magento 2?

The reason is I am building an Mobile app and website based on Angular and I wanted that only my app and website should have access to all the API.


To disable Anonymous Guest Access Go to

Admin > Menu > Store > Configration > Services > Magento Web API > Web API Security

Allow Anonymous Guest Access set to No

If you Set Allow Anonymous Guest Access set to No, Magento Website will not function properly as some API is used by Magento Checkout Process. You have to disable Guest Checkout.

Check http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html

  • As mentioned in question I have checked the documentation already. It restrict only Catalog, Store, CMS related api's. My question is how I can restrict the access to API other than Catalog, Store and CMS pages. Jun 1 '17 at 12:34
  • Have you tried it, Catalog, Store, CMS api are not public by default. Jun 2 '17 at 5:25
  • Yes they are restricted by default. But there is no restrictions provided by default magento on other api's like customers, Quote etc... I want to add restriction all the other api's too. Jun 2 '17 at 6:20

I am currently on Magento 2.2 Commerce instance. We ran into similar issues when we found spammers were creating accounts by hitting the customer APIs. Magento support stated some APIs remain open because the app uses these internally. For example, some APIs are used for guest checkout process.

Some of these can be seen by reviewing underlying code:


<route url="/V1/customers" method="POST">
        <service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
            <resource ref="anonymous"/>

As you can see the resource is hard coded to allow anonymous. So basically some APIs will not adhere to configuration settings in the UI.

I would recommend starting by reviewing the webapi.xml file of the particular API you are concerned about. If you really want to change this you will need to do a customization that overrides the resource in the appropriate webapi.xml file.

Personally, I am not a fan of the approach Magento took. In my view, open APIs are a bad practice. I did put in a feature request asking Magento to review this issue and have a solution that would not require anonymous access to the APIs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.