---
title: "Walkthrough: Enabling and authorizing requests to the Authoring and Management API"
slug: "walkthrough--enabling-and-authorizing-requests-to-the-authoring-and-management-api"
abstract: "Enable GraphQL IDE to perform operations against the Authoring and Management GraphQL API"
---
# Walkthrough: Enabling and authorizing requests to the Authoring and Management API

You can explore the Authoring and Management API through HTTP requests. Querying the GraphQL Authoring and Management API programmatically requires authorization.

This walkthrough describes how to:

- Enable GraphQL
- Obtain an access token
- Authorize HTTP requests

<details>
<summary><h2>Enable GraphQL</h2></summary>

Before using GraphQL, you must enable it in your settings.

To enable GraphQL:

- In a Sitecore configuration patch file, add the following setting:

    ```xml
    <setting name="GraphQL.Enabled" value="true" />
    ```

</details>

<details>
<summary><h2>Obtain an access token</h2></summary>

To authorize HTTP requests to perform operations against the Authoring and Management API endpoint, you must obtain an access token.

To obtain an access token:

1. [Configure a controller that retrieves a Bearer type access token from the Sitecore Identity Server](https://doc.sitecore.com/xp/en/developers/105/sitecore-experience-manager/use-bearer-tokens-in-client-applications.html "Use bearer tokens in client applications").
2. Navigate to the controller in a browser. If authentication is successful, the access token is displayed on the page.
3. Copy the `Access token` value.

</details>

<details>
<summary><h2>Authorize HTTP requests</h2></summary>

All HTTP requests to the Authoring and Management API endpoint must be authorized. Tools like Postman or Insomnia can be used to send and validate these requests

To authorize your HTTP requests:

- Add the HTTP `Authorization` header with the `Bearer` authentication scheme to your request headers. Replace the `<access-token>` placeholder with the value of the access token. For example:

    ```csharp
    {
        headers: [
            { "Authorization": "Bearer <access-token>" }
        ]
    }
    ```
- To test the authorization for your HTTP request, verify your setup by running a query. For example:

    ```json
     query {
        sites{
            name
        }
    }
    ```

</details>

## Bearer token for local API discovery

As an alternative for local development and API discovery, you can obtain a bearer token without creating a custom application by configuring a lightweight OAuth client in Sitecore Identity Server and requesting a token directly from the `/connect/token` endpoint.

This approach is commonly used with tools such as Postman, curl, or PowerShell to enable quick experimentation with the Authoring and Management API or GraphQL Playground.

> [!warning]
> This approach requires changes to Sitecore Identity Server configuration and may involve grant types intended for development or testing only. It is not recommended for production environments.
>
> For production scenarios, use the application-based authorization flow described earlier in this topic.

At a high level, this approach involves:

- Adding a client configuration to Sitecore Identity Server with the required API scopes
- Requesting an access token from:

    ```text
    https://<identity-server>/connect/token
    ```

- Supplying the returned access token as a bearer token in API requests:

    ```text
    Authorization: Bearer <access_token>
    ```

This option is intended to reduce friction for local exploration and troubleshooting only.