So I need to retrieve an item using the sitecore API. So firstly, I need to log in, Im following what this site states:


But then again, Im getting a 401 unauthorized error with the right credentials (I tested it loggin in the browser). There it says that loggin in only responds over HTTPS. How can I access an item using the sitecore API if I the sitecore web site doesnt use Https ?

Sitecore 8


2 Answers 2


Unfortunately, your site needs to be secured. There's no way to override the HTTPS requirement unless you override the /ssc/auth route and use your own login mechanism.

NOTE: I don't recommend below but if you MUST really not have HTTPS...

You can do this by updating the Sitecore.Services.RouteMapper setting in the Sitecore.Services.Client.config. Reflect the DefaultMapper and override the MapRoutes method that defines the "auth" route. You'll notice that it's pointing to Sitecore.Services.Infrastructure.Sitecore.Mvc.ServicesAuthenticationController. So, you'll need to copy that and essentially remove the "RequireHttps" attribute on the Login method. Point your new auth route to this new controller.

With regards to more details on the SSC, you may want to check the 7.5 documentation as it has a lot more examples. Most of it still applies.

  • 1
    This is the solution I needed. I agree that in most circumstances this should never be done, however for dev environments or production environments where SSL is offloaded (e.g. behind a load balancer or downstream web server which provides the SSL) then this is an absolute must. Sitecore themselves have even introduced a setting Sitecore.Services.AllowToLoginWithHttp to disable the https requirement in the most recent version 9.3 doc.sitecore.com/developers/93/sitecore-experience-manager/en/…
    – theyetiman
    May 15, 2020 at 10:17

If you just want to do this on your local machine for dev purposes (e.g self signed cert in IIS) then you can do the following to work-around the SSL validation:

requestUrl = $"https://{_baseAPIUrl}/sitecore/api/ssc/auth"
var request = WebRequest.CreateHttp(requestUrl);
request.Method = "GET";
request.ContentType = "multipart/form-data";

//ignore ssl cert validation - enabled for local dev only
if (_skipSslCertValidation)
    request.ServerCertificateValidationCallback += (sender, certificate, chain, sslPolicyErrors) => true;

However Please Do Not use this in any other environments as it will open up a security hole with invalid certs. Chrome and Firefox now mark websites as insecure if they don't run under SSL. Therefore you should use SSL in all environments where possible now anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.