title: How to disable windows authentication for WEB API inside an ASP.NET MVC 3 application
body: <p>I have an ASP.NET MVC 3 application with Windows authentication. Now I've added the web api to  it (nuget package) and want anonymous access (later on I'll add an api key). But I haven't managed to get it to work.</p>
  
  <p>All my WEB API controllers are under the "/api" path, and none of them have the Authorize attribute.</p>
  
  <p>Here's my current web.config (I removed all the bits and pieces that are irrelevant to this matter):</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
    &lt;system.web&gt;
      &lt;authentication mode="Windows" /&gt;
      &lt;httpRuntime maxRequestLength="102400" requestPathInvalidCharacters="&amp;lt;,&amp;gt;,*,:,&amp;amp;,\" /&gt;
      &lt;authorization&gt;
        &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
      &lt;roleManager enabled="true" defaultProvider="AspNetSqlRoleProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="..." applicationName="..." /&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
      &lt;profile enabled="false" defaultProvider="AspNetProfileProvider"&gt;
        &lt;providers&gt;
          &lt;clear /&gt;
          &lt;add name="AspNetProfileProvider" type="System.Web.Profile.SqlProfileProvider" connectionStringName="..." applicationName="..." /&gt;
        &lt;/providers&gt;
        &lt;properties&gt;&lt;/properties&gt;
      &lt;/profile&gt;
      &lt;customErrors mode="RemoteOnly" defaultRedirect="~/Error/Generic"&gt;
        &lt;error statusCode="404" redirect="~/Error/NotFound" /&gt;
        &lt;error statusCode="403" redirect="~/Error/AccessDenied" /&gt;
      &lt;/customErrors&gt;
    &lt;/system.web&gt;
    &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;security&gt;
        &lt;requestFiltering allowDoubleEscaping="true"&gt;&lt;/requestFiltering&gt;
      &lt;/security&gt;
    &lt;/system.webServer&gt;
    &lt;location path="Error"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;location path="Scripts"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;location path="Content"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;location path="api"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>All my requests are getting "HTTP Error 401.2 - Unauthorized", but when I enter some valid windows credentials then the request executes successfully.</p>
  
  <p>So, how can I disable the windows authentication for my WEB API? thanks in advance.</p>