I am using Sitecore 9.1. I am trying to do some operation on Sitecore XConnect APIs from some third party tool. I need to authenticate the APIs either using xconnect certificate or authentication token.

I tried to get an authentication token by calling the endpoint https://abc-identity.local.xyz.com/connect/token from postman but seems it does not work.

Can you please suggest how can we implement authentication for XConnect APIs from a third party tool. Regards, Arun

3 Answers 3


You can use HTTP requests to run the Web API for xConnect Data Tool tasks from your content management (CM) instance.

The CM authentication restricts access to the Data Purge Web API. You must log in to the CM with the sitecore\Sitecore XConnect Data Admin role, which authorizes requests for Data Tools operations.

All users that run Data Tools operations via the Web API or the XConnect CLI plugin must also have admin rights or be assigned to the sitecore\Sitecore XConnect Data Admin role.

To get access to the Web API for xConnect with tools that let you send GET and POST requests, such as Postman, you must send an authorization header with an OAuth2 bearer token.

To request this token in, for example, Postman:

  1. In the authorization header, fill out the following form fields to configure the token:

enter image description here

  1. Click Request Token, then click Use Token. This adds the token to the headers of your requests and grants you permission to submit requests to the Web API.

For more info follow this - https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-platform/get-an-access-token-for-web-api-for-xconnect.html

Although this document is for Sitecore 10.1 but you can give it a try.

If this doesn't work then worth a read - https://joaoneto.blog/enable-different-authentication-methods-to-xconnect-odata/

  • I tried this but its not working. The article is for Sitecore 101. so I am not sure this works for 9.1 too. Nov 9, 2022 at 13:22
  • I am getting the error in console :Error: unable to verify the first certificate: Nov 9, 2022 at 13:25
  • How did you provide client secret? See this article Nov 9, 2022 at 13:36

If you have a look at this repo (from Alistair Deneys), its main focus is collating data and sending it to the cortex engine for processing:


However, if you look at the Application.cs file (called by console application). You will find some useful code, that shows how to make an authenticated connection to XConnect (using client certificate thumbprint):

private async Task<XConnectClient> CreateXConnectClient()
    if (_xConnectClientConfiguration == null)
        _xConnectClientConfiguration = await CreateXConnectClientConfiguration();

    return new XConnectClient(_xConnectClientConfiguration);

private async Task<XConnectClientConfiguration> CreateXConnectClientConfiguration()
    System.Console.WriteLine("Initializing xConnect configuration...");

    var uri = new Uri(_config.GetValue<string>("xconnect:uri"));
    var certificateSection = _config.GetSection("xconnect:certificate");
    var handlerModifiers = new List<IHttpClientHandlerModifier>();

    if (certificateSection.GetChildren().Any())
        var certificateModifier = new CertificateHttpClientHandlerModifier(certificateSection);

    var xConnectConfigurationClient = new ConfigurationWebApiClient(new Uri(uri + "configuration"), null, handlerModifiers);
    var xConnectCollectionClient = new CollectionWebApiClient(new Uri(uri + "odata"), null, handlerModifiers);
    var xConnectSearchClient = new SearchWebApiClient(new Uri(uri + "odata"), null, handlerModifiers);

    var xConnectClientConfig = new XConnectClientConfiguration(_xDbModel, xConnectCollectionClient, xConnectSearchClient, xConnectConfigurationClient);
    await xConnectClientConfig.InitializeAsync();

    System.Console.WriteLine("xConnect configuration has been initialized");
    return xConnectClientConfig;

Extending the answer given by @Gaurav, as per your comments, if you are getting the error unable to verify the first certificate you should try this.

Disable SSL Verification within Postman.

  • Open Postman, then select File -> Settings
  • Select the General tab.
  • Move the slider for SSL certificate verification to the OFF position.

enter image description here

Read more in this article.


  • yes, from Postman after disabling ssl it works but in actual implementation I have to keep the ssl enabled. Nov 9, 2022 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.