TL;DR: Sitecore services client 403 when login called from a different web application (IIS process), but not when called from Postman

PROBLEM: RESTful Web API (web service) written in C# running on IIS/Azure (different machine than Sitecore) calling Sitecore services client. Calling the endpoint /sitecore/api/ssc/auth/login over the network via HTTP always returns HTTP status code 403 Forbidden.

To be clear: I am using the Sitecore Restful API directly. Not using JavaScript. Not using SPEAK components.

SYMPTOMS: Calling /sitecore/api/ssc/auth/login works with Postman and a console test app I wrote to POST data. These work after I changed the "Sitecore.Services.Client.config" file from the default "ServicesLocalOnlyPolicy" to "ServicesOnPolicy".

Worked with Sitecore v8.x, but stopped working once we upgraded to Sitecore v9.x


  • Other settings changed, but have no affect, in the Sitecore services client config:
<setting name="Sitecore.Services.AllowToLoginWithHttp" value="true" />
<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />
  • Searched Google, StackExchange, StackOverflow, and I read the Sitecore documentation ("Developer's Guide to Sitecore.Services.Client"), but no resolution.

  • I checked IIS logs for more detail on the 403, but nothing.

  • Nothing in the Sitecore logs - I don't see anything regarding this error.

What else should I check?

1 Answer 1


By default, Sitecore services can be accessed from the local host machine only without log in (ServicesLocalOnlyPolicy). ServicesOnPolicy will allow you to log in through "/sitecore/api/ssc/auth/login" and get the necessary token/cookie depending on your setup. If you want to bypass this behavior you can add your controller to allowed controllers section.

        <configuration type="Sitecore.Services.Infrastructure.Configuration.ServicesConfiguration, Sitecore.Services.Infrastructure">
          <allowedControllers hint="list:AddController">
            <allowedController desc="MyController">MyNamespace, MyDll</allowedController>
  • Perhaps there is a mis-understanding. I have a RESTful web service on a different machine calling the Sitecore services client over HTTP, making an HTTP Post to /sitecore/api/ssc/auth/login. I don't see how my adding what you suggest will help. Can you explain?
    – T H
    Jan 11, 2022 at 14:41
  • Have you checked showconfig.aspx to ensure ServiceOnPolicy is correctly patched there?
    – Kamil C
    Jan 11, 2022 at 15:55
  • Yes, it shows: <setting name="Sitecore.Services.SecurityPolicy" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" patch:source="Sitecore.Services.Client.config"/>
    – T H
    Jan 11, 2022 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.