Hi bazzagan,

"Fake" web browser request from console app: you would need to request the login form page (and your console client needds to have cookies enabled) so that you get the needed Episerver CMS cookies (see the link for the cookie names) and then you would do a post with username, password and the needed cookies (the xsrf cookie value needs to be also sent in the hidden field of the form, look the names from the login page html source). if the login succeeds then you have in the response cookies your roles etc and then can call your API wit those cookies and get the OOB Authorize attribute fuinctionality what I assume you are using at the moment). The console app request implementationis then naturally up to you if you will use HttpClient or WebRequest to make the actual requests to the login page.

Another approach might be use some sort of API key that the client sends when requesting data from the API and in your API instead of AuthorizeAttribute you use your custom implementation to validate that the client is allowed to do the request.

Thanks Antti. That is just what I needed. I grabbed the cookies and posted them with each request using HttpClient and all was happiness. Have a great day :)

Hi bazzagan, good to hear.

If I may ask one thing, could you mark my reply as answer :D so others know too there is a solution for your question.