I as well am getting this error in postman.

    "message": "The consumer isn't authorized to access %resources."

Another thing i noticed is it's saying 400Bad Request and when i hover over it says "the request can not be fulfilled do to bad syntax".

I checked the syntax in a json validator and it says it's good.

for this api:


In the Web API Security I have the dropdown set to "No" for allow anonymous guest access but when i turn it to yes it hits it's endpoint. This issue only started happening after i upgrade to 2.4.3-p1. This is super frustrating and I need some assistance.

1 Answer 1


"The consumer isn't authorized to access %resources." error message comes when the API end point resource is "Self" so for this you need to pass customer token in that API not only in this API but in every "Self" resource API. As we know there are 3 types of resource in Magento API: **1.

- Administrator or Integration Resources for which administrators or integrator are authorised. For example, if administrators are authorised for the Magento_Customer::group resource, they can make a GET /V1/customerGroups/:id call.

  • Customer : Resources with "anonymous" or "self" permission.
  • Guest user : Resources with anonymous permission

so there are 3 types or resources when you check the end point which you are hitting you will see in it's webapi.xml file that resource type is self which is number 2 point.

For This you need to generate a customer token using magento default Customer Token API using below end point:


and need to pass below request Parameter:

"username": "pass customer email id",
"password": "pass customer password",
"device":"Device type from which you login"

Once you pass these and hit this POST API then it will return a token for you then you just need to pass it in you API header where you were facing the error to pass in header you have to pass it like:

Authorization :bearer<space><the token generated for customer>

once you do this API will hit. for more information about resources you can follow Authentication Dev Docs by Magento.

PS: This customer Token generate automatically when customer get login so you just need to pass that token in all those API which are "self" type.

  • I've already created the token for myself and put it into postman as the bearer authorization token. @IZANOVA
    – Head
    Aug 28, 2022 at 19:13
  • 1
    let me know if it work? Aug 28, 2022 at 19:15
  • it's not working but it was working fine in 2.3.4 and we just upgraded all the way to 2.4.3-p1 and not it's working. It's weird because some of my other custom API's work fine but this one is throwing unauthorized.
    – Head
    Aug 29, 2022 at 2:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.