I have been importing data just fine using Feed Me Feed URLs that point to .json files placed above web root. (It's a great plugin.)

But for some kinds of import I now want a Feed URL to be an https addressable URL that is nonetheless not publicly viewable to anyone who knows the URL.

So I thought I'd be able to do the following:

  1. Allow my client to compile JSON formatted data via a tool I've made
  2. Paste that data into a Globals field that generates a template generated URL with a JSON mime type
  3. Have that template only render its content if the viewer is logged in
  4. Point Feed Me at that URL, on the assumption that it too is 'logged in' to its own CMS

But it turns out that Feed Me doesn't play with step 3, even though it's a relative URL specified as:


I guess I can have the template be sensitive to an obscure URL parameter instead of logged in state.

Any other ideas?

Update 1

FWIW the param approach works fine, so that:


…renders nothing but…


…renders the data.

So I point Feed Me at the latter.

Update 2

I just found the docs section on configuring requestOptions, which suggests to me that there is a way to have Feed Me be governed by authentication, but I'm too dumb to make sense of what it might be trying to tell me.

Can someone help me join the dots?

  • 1
    requestOptions is passed directly onto Guzzle, which will use HTTP basic auth headers. So you should be able to secure the feed with HTTP basic auth via .htaccess/nginx confi/etc.
    – Brad Bell
    Commented Mar 25, 2021 at 22:59
  • Caveat: I've never tried it myself.
    – Brad Bell
    Commented Mar 25, 2021 at 22:59


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.