I don't know if this is a bug in Magento 2 API or not, so I didn't post it on Magento 2 Github issues.

According to this link: http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-session.html:

Customers can access resources that are configured with anonymous or self permission in the webapi.xml configuration file.

I tried login Magento 2 storefront, then I went to magento_host/rest/V1/customers/me on the browser (which has "self" permission), I still got error

Consumer is not authorized to access %resources

I tried to create a custom API which also has "self" permission, I got the same error.

I'm using Magento 2.1.7.

Anyone know why? Thank you.


The session based authentication (with "self" permission) is only allowed to AJAX calls and not to browser requests due to security vulnerabilities.

  • Thanks for the answer. Could you please share the example of it? – Keyur Shah Dec 4 '17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.