I have Drupal 7 installed locally on my computer with the domain set to http://drupal.local.

I am trying to prepare an external script in PHP or Python (or even in pure Bash using curl, if it does not require a lot of extra work), which will successfully execute an HTTP request by default available only for the logged in user.

To understand what such a HTTP request should look like, I am first trying to perform such a HTTP request using Postman, but all my attempts failed.

This is what I've done so far:

  1. In the browser, I logged in as administrator of the Drupal 7 site
  2. I opened the browser on http://drupal.local/en/node/add/article and I received status 200 (The page is displayed correctly in my browser.)
  3. In Postman I set:
    • request method on: GET
    • URL: http://drupal.local/en/node/add/article
    • Headers: I set all headers identically to those in the browser including the current cookies containing the session key with its value
  4. I don't have access to this page and I receive a 403 error

How do I construct an authenticated HTTP request in Postman that will work for Drupal 7?

1 Answer 1


You can make use of Token authentication but be careful:

From module description:

Be careful with what paths you expose to Token Authentication, as it is effectively a very simple, very low security password mechanism. You can expose Administration pages through bad configuration.

  1. Install / enable Token authentication Module.
  2. Go to admin/config/services/tokenauth
  3. Add the path you want to give access to with token. enter image description here in the example below i added all add content pages.
  4. Go to admin/people edit the user you want to generate token.
  5. Generate Token by clicking on Token authentication tab it will give a token for that user like ?token=tuvj7cMwauxStWGVQYfo.
  6. Then you can use it with postman. enter image description here

Note: it may not be the best way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.