I'm trying to call REST endpoints from the browser. Initially, I'd like to be able to fetch product information.

It looks like session-based authorization is what I'm after.

I started by grabbing a Javascript swagger client from npm.

Now I'm trying to make a simple call to fetch products (I have but one in my local site currently).

m2.catalogProductRepositoryV1GetListGet().done((rsp) => {
  console.log('Products: ', rsp.body)

However, I'm getting a 401. Then I see this note in that same session-based-auth doc mentioned above

Customers can access resources that are configured with anonymous or self permission in the webapi.xml configuration file.

So I look in vendor/magento/module-catalog/etc/webapi.xml

<route url="/V1/products" method="GET">
    <service class="Magento\Catalog\Api\ProductRepositoryInterface" method="getList"/>
        <resource ref="Magento_Catalog::products" />

Notice no anonymous or self permission here. Now I'm thinking really? Products are not allowed to be consumed by the browser out of the box?

I'm understand Magento_Catalog::products refers to a Resource Model. I'm now trying to define and ACL, however, I'm unsure how to associate the ACL with public (not-logged in) users.

  • You can check version 2.3 with graphQL support that should allow to fetch product data without ACL (I am not sure what is the current scope of data available there).
    – Zefiryn
    Jan 17, 2019 at 21:09
  • Thanks @Zefiryn, it looks like I could spend a week wrapping my head around this lol. Jan 17, 2019 at 21:36

2 Answers 2


You can create an API clone from that API:

<route url="/V1/all_products" method="GET">
<service class="{{your calss}}" method="getList"/>
    <resource ref="annoymous" />

After that, call your api and you can get them from anywhere without permission.

  • Thanks for your answer! While this might work it is less than ideal for a couple of reasons: 1. LOTS of code duplication, 2. Client library needs to be hacked to change URLs for EVERY endpoint Jan 17, 2019 at 20:02
  • Giving an upvote as I got this approach to work, but I gather GraphQL is the "right way" to do this from 2.3 onwards. That said, I need to learn GraphQL before that's remotely viable, lol. Jan 17, 2019 at 22:05
  • also, I found a setting . Hope it can solve your issues unless clone api: configuration > service > magento web api >Allow Anonymous Guest Access > Yes
    – the light
    Jan 19, 2019 at 14:36
  • Thanks, I will check this out on Tues and get back to you! Jan 20, 2019 at 20:50
  • spelling mistake in <resource ref="annoymous" />
    – Wolfack
    Apr 20, 2023 at 7:17

It turns out you don't need to subclass as suggested in the previous answer, you can expose a built in interface directly in webapi.xml e.g.:

<route url="/V1/custom/products/attributes/:attributeCode" method="GET">
    <service class="Magento\Catalog\Api\ProductAttributeRepositoryInterface" method="get"/>
        <resource ref="anonymous" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.