I need to generate authentication Token for guest user. I have checked in documentation, we can only generate Auth Token for customer and admin. Other resource can be accessed using anonymous role.

But as per application logic we are developing, It is require to save some user specific values to provide data.


The Magento web API framework allows guest users to access resources that are configured with the permission level of anonymous. Guest users are users who the framework cannot authenticate through existing authentication mechanisms. As a guest user, you do not need to, but you can, specify a token in a web API call for a resource with anonymous permission.

Refer this link for more details - http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html

Note : On a conclusion we can not generate authentication token for guest user as it have anonymous role. if you still want to save user specific information then override customer restApi model file and create your custom function for that.

  • Thanks, Could you please share some idea like where I can write my own function for generating new token Jul 21 '17 at 5:40
  • @PankajPareek for guest user you really don't needed token , what i am trying to say is if you want to store some information you need to override core module api , likewise i am working on catalog api so i needed category image via api so have override core category rest api model and then written my own logic for the same . Hope you understand Jul 21 '17 at 5:42
  • Yes but to identify guest customer specific data I need to generate token otherwise how I can identify guest specific data Jul 21 '17 at 5:52
  • Well you can manage that thing by login checkpoint from session , if used is logged in then it is not guest and if it is not logged then its guest , then save the information. In your case you are saying you will generate token for each guest user? Jul 21 '17 at 6:00

Please explain how we can allow the permissions for custom api module for diffrent role customer and guest please explain with screenshot. if we set anonymous role in webapi.xml. then every one can access api data, we want restrict to everyone means allow permission for customer or guest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.