Multiple header autorization bearers possibility or get around cors error?

Hi! Calling IONAPI uses header Autorization = bearer + ionapitoken. But the IONAPI calling an external API also uses header Autorization bearer + externaltoken. Try to enter both on the same line in code separated with a comma but when running this only the Autorization = bearer + ionapitoken shows in debug so I get invalid token error in response from external API site. How to get around this? Alternate way is to call external api directly but then I get cors error. If someone knows how to get around the cors error that will also be fine.

Find more posts tagged with

Widget Development

Accepted answers

All comments

Legacy Contributor

Hi Jan,

You can set up the authentication mechanism in the IONAPI Suite using the "Targe Endpoint Security".

Legacy Contributor

Hello! Yes, we do this (use OAuth 2.0 with username and password) to fetch the token from external site. But when we then shall use this token in the next api to get further information from external site we get the problem. We cannot then also use OAuth 2.0. We must use the token we got from first api-call.

Daniel Henningsver

The target endpoint security as Sudhakaran describes handles the authorization between the ION API Gateway and the external api, this is done automatically. When you then call the CustomAPI through the ION API Gateway you only need to authorize against ION API.

Once you have configured the external api in ION API, can you test it there, does it work?

Copyright © 2025 Infor. All rights reserved.