We have a remote instance http://dev-instance/sitecore/login.
I have followed all the steps in this article and got the token in postman for https://dev-instance/sitecore/api/ssc/auth/login

But when trying to get an item's info using, https://dev-instance/sitecore/api/ssc/item/{item-id}, it gives no result and shows 403 forbidden.

When I try to browse the same URL (logged into CMS in another tab), it says:

Access to dev.instance was denied
You don't have authorization to view this page.

sitecore\servicesAPI user has read access to that item.

When I browse the URL in the remote system which has the instance, it returns the JSON data.

Is there some more configuration that needs to be done. or should the secret key used in connection string be of any specific format?

Using Sitecore 8.2 update 5

  • How is this different from sitecore.stackexchange.com/questions/9448/…?
    – Mark Cassidy
    Commented May 30, 2018 at 9:17
  • @MarkCassidy I guess its similar, but the issue remains. I got the token in postman after passing the credentials. The 403 is when I try to get item info. Sitecore.Services.AllowAnonymousUser is set to true
    – sukesh
    Commented May 30, 2018 at 9:25

1 Answer 1


Below are different security policies for the Sitecore services. These were mentioned in "Sitecore.Services.Client.config". In order to make your services accessible remotely we would need to set Option #3 mentioned below. Option #2 is the default one.

  1. Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOffPolicy: Policy denies access to all Entity and Item Services.
  2. Sitecore.Services.Infrastructure.Web.Http.Security.ServicesLocalOnlyPolicy: Policy denies access to all Entity and Item Services from requests originating from remote clients.
  3. Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy: Policy allows access to all Entity and Item Services

More details can be found here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.