diff --git a/application/Espo/Core/Api/Auth.php b/application/Espo/Core/Api/Auth.php
index 6d68c4bef8..c07971f983 100644
--- a/application/Espo/Core/Api/Auth.php
+++ b/application/Espo/Core/Api/Auth.php
@@ -68,16 +68,26 @@ class Auth
         $this->isResolvedUseNoAuth = true;
     }
 
+    /**
+     * Logged in succesfully.
+     */
     public function isResolved() : bool
     {
         return $this->isResolved;
     }
 
+    /**
+     * No need to log in.
+     */
     public function isResolvedUseNoAuth() : bool
     {
         return $this->isResolvedUseNoAuth;
     }
 
+    /**
+     * Determines which auth method to use. Fetches a username and password from headers and server parameters.
+     * Then tries to log in.
+     */
     public function process(Request $request, Response $response)
     {
         $httpMethod = $request->getMethod();
@@ -95,6 +105,8 @@ class Auth
             $authenticationMethod = 'Hmac';
         } else if ($request->hasHeader('X-Api-Key')) {
             $authenticationMethod = 'ApiKey';
+        } else if ($request->hasHeader('X-Auth-Method')) {
+            $authenticationMethod = $request->getHeader('X-Auth-Method');
         }
 
         if (!$authenticationMethod) {
diff --git a/application/Espo/Core/Utils/Auth.php b/application/Espo/Core/Utils/Auth.php
index 9a0f44454b..61f236c304 100644
--- a/application/Espo/Core/Utils/Auth.php
+++ b/application/Espo/Core/Utils/Auth.php
@@ -146,6 +146,13 @@ class Auth
     ) : ?array {
         $isByTokenOnly = false;
 
+        if ($authenticationMethod) {
+            if (!$this->metadata->get(['authenticationMethods', $authenticationMethod, 'api'])) {
+                $GLOBALS['log']->warning("AUTH: Trying to use not allowed authentication method '{$authenticationMethod}'.");
+                return null;
+            }
+        }
+
         if (!$authenticationMethod) {
             if ($request->getHeader('Espo-Authorization-By-Token') === 'true') {
                 $isByTokenOnly = true;
diff --git a/application/Espo/Resources/metadata/authenticationMethods/ApiKey.json b/application/Espo/Resources/metadata/authenticationMethods/ApiKey.json
new file mode 100644
index 0000000000..a5b6aa0f51
--- /dev/null
+++ b/application/Espo/Resources/metadata/authenticationMethods/ApiKey.json
@@ -0,0 +1,3 @@
+{
+    "api": true
+}
\ No newline at end of file
diff --git a/application/Espo/Resources/metadata/authenticationMethods/Espo.json b/application/Espo/Resources/metadata/authenticationMethods/Espo.json
index 70286bddd4..7064c8ffdf 100644
--- a/application/Espo/Resources/metadata/authenticationMethods/Espo.json
+++ b/application/Espo/Resources/metadata/authenticationMethods/Espo.json
@@ -1,5 +1,4 @@
 {
-
     "settings": {
         "isAvailable": true
     }
diff --git a/application/Espo/Resources/metadata/authenticationMethods/Hmac.json b/application/Espo/Resources/metadata/authenticationMethods/Hmac.json
new file mode 100644
index 0000000000..a5b6aa0f51
--- /dev/null
+++ b/application/Espo/Resources/metadata/authenticationMethods/Hmac.json
@@ -0,0 +1,3 @@
+{
+    "api": true
+}
\ No newline at end of file
diff --git a/application/Espo/Resources/metadata/authenticationMethods/LDAP.json b/application/Espo/Resources/metadata/authenticationMethods/LDAP.json
index bc2ee3e8ce..7803e4c652 100644
--- a/application/Espo/Resources/metadata/authenticationMethods/LDAP.json
+++ b/application/Espo/Resources/metadata/authenticationMethods/LDAP.json
@@ -1,5 +1,4 @@
 {
-
     "settings": {
         "isAvailable": true,
         "layout": {