In the developer docs I've found the option to unrestrict API access. Is there an option to restrict access to the API for everything i.e. nothing is anonymous? Or is there a way to disable the magento API?

Maybe I misunderstand but seems like bots can spam your API endpoint to retrieve a lot of information.



Am I correct in saying that Magento 1 doesn't allow anonymous access?

  • If you disable Magento 2 API, your checkout won't work anymore. – Jonathan Ribas Jun 10 '19 at 21:11
  • Do you think this is a good idea? Surely it would have been a good idea to automatically generate a checkout api user on install and use this user on the checkout? – Dominic Xigen Jun 10 '19 at 21:36
  • If you want to protect the then i suggest to use Web firewall. The application cannot stop hitting at URL & rest points.If you have too bot traffic at the network level.So suggest using Web-firewall – Amit Bera Jun 11 '19 at 3:52
  • there is only God and one crazy magento developer know why API works this way... – MagenX Jun 11 '19 at 9:56
  • @AmitBera Sounds good. Am I right in saying Magento 1 doesn't allow anonymous access? – Dominic Xigen Jun 11 '19 at 11:26

using nginx correct way would be to map all API endpoints and configure some access logic.

map $request_uri $api_access {
        default 0;
        ~/(.*)/V1/carts/mine                        0; # example to pass?
        ~/(.*)/async/bulk/V1/customers              1;
        ~/(.*)/V1/customers(?!/me)                  1;
        ~/(.*)/V1/customers/password                1;
        ~/(.*)/V1/customers/resetPassword           1;
        ~/(.*)/V1/customers/isEmailAvailable        1;
        ~/(.*)/V1/guest-carts/                      1;
        ~/(.*)/V1/integration/                      1;
        ~/(.*)/V1/products-render-info              1;
        ~/(.*)/V1/search                            1;
        map every endpoint you like!

if ($api_access) { 

    some logic to log / verify / limit access;
    set $foo bar;
    rewrite @to_magento;


disable guest checkout is also good option, today in online business is better to know your customers are legit.

| improve this answer | |
  • have you restricted API access in anyway? – Dominic Xigen Jun 14 '19 at 16:33
  • you can block it completely and only allow access for specific use. like ERP etc... – MagenX Jun 14 '19 at 16:51
  • i believe that API must be separate from application itself, running remotely only, running it within the application is stupid. – MagenX Jun 14 '19 at 16:56
  • I have exactly the same feeling. Although I felt stupid making a fuss about it. But it just didn't sit me right either. – Dominic Xigen Jun 14 '19 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.