I have installed Sitecore commerce 9.1.0. The setup is working fine but I am not able to configure Postman.

To configure postman I have

  • disabled SSL Certificate validation in Postman

  • "AntiForgeryEnabled":false in C:\inetpub\wwwroot\CommerceAuthoring_Sc910\wwwroot\config.json

The Get Token api is working fine and SitecoreIdToken is also set to correct value

Is there anything that I have missed out?

enter image description here

enter image description here

  • You will need to pass valid Bearer Token with your request parameters.
    – S.Kazmi
    Jun 24, 2019 at 6:26
  • I have verified that the token is generated and SitecoreIdToken is set . Jun 24, 2019 at 10:39
  • can you please provide screenshot of header values you are passing Jun 24, 2019 at 18:55
  • In this case, please check expiry of the token and see if you are passing a valid token.Can you also share the screen shot of postman where you are passing token.
    – S.Kazmi
    Jun 24, 2019 at 23:07
  • @S.Kazmi I have added the screenshot. Jun 25, 2019 at 3:54

1 Answer 1


This is one of the Sitecore Commerce Engine instance security fact. Please ensure that the value of SitecoreIdServerHost postman environment variable is exactly similar to SitecoreIdentityServerUrl and also whitelisted under AllowedOrigins property (under config.json) of your Commerce Engine Instance which you're trying to access (Auth/Shops etc.).

In my case I have two bindings (localhost as well as friendly host name) on SitecoreIdentityServer instance and I was receiving the token using localhost binding (which comes by default in postman) but only the friendly host name was listed under Commerce Engine. This is also the common issue if you are working with scaled architecture. Hope it helps!

  • 1
    This was the answer for me. The SitecoreIdServerHost in my postman environment was without "https://" while the value of SitecoreIdentityServerUrl included "https://". Adding "https://" in postman solved the problem.
    – ebug
    Jan 30, 2020 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.