I'm setting up a OAuth2 Server using the OAuth2 Server module. Everything tests out as expected. I login, get the authentication code, which I then trade in for an access_token, which tests out successfully.

The issue comes when requesting a resource that's handled by the services module. It looks like it's starting a session for the anonymous user instead of calling the other authentication hooks.

After all, if one authentication method fails, it shouldn't assume that it's the only authentication method possible.

Any ideas on how to use OAuth2 authentication code authorization to access services endpoints?

Here's the snip from services.runtime.inc line 116 where it's only looking for one authentication module, it seems.

foreach ($endpoint->authentication as $auth_module => $settings) {
  if (isset($settings) && $auth_error = services_auth_invoke($auth_module, 'authenticate_call', $settings, $controller, $args)) {
    return services_error($auth_error, 401);
  • You probably didn't apply the Services patch mentioned on the OAuth2 Server project page (it has since been committed and is present in the Services -dev release). You only need the OAuth2 authorization, no need to enable the Session one. Jan 30, 2014 at 13:23

1 Answer 1


Make sure the selected authentication methods are enabled for the server, e.g:


REST server settings


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.