diff --git a/VERSIONS_WIP/72610 b/VERSIONS_WIP/72610
new file mode 100644
index 0000000000000000000000000000000000000000..fe60a378c61b4522e039875ac443b64bc691dd53
--- /dev/null
+++ b/VERSIONS_WIP/72610
@@ -0,0 +1 @@
+ - ticket #72610 : OAuth: ajouter la variable pour autoriser HTTP (OAUTH_ACCEPT_HTTP)
\ No newline at end of file
diff --git a/application/modules/api/controllers/UserController.php b/application/modules/api/controllers/UserController.php
index 3ad7af8a08da99d9412265e7e8a0841d81af1c08..cd6dd53494cfc3bda65393679e1b8f968cbbd589 100644
--- a/application/modules/api/controllers/UserController.php
+++ b/application/modules/api/controllers/UserController.php
@@ -22,7 +22,7 @@
 
 class Api_UserController extends ZendAfi_Controller_Action {
   public function loansAction() {
-    if (!$this->_request->isSecure())
+    if (!($this->_request->isSecure() || Class_AdminVar_OAuthAcceptHTTP::isEnabled()))
       return $this->_error($this->_('Protocole HTTP obligatoire'));
 
     if (!$authorization = $this->_request->getHeader('authorization'))
diff --git a/library/Class/AdminVar.php b/library/Class/AdminVar.php
index 4e32cd8c416f8803cfe9205973f595e1f4b900f6..c339d9679b93bf62f8f7d20ceeffc5ea9cb55df3 100644
--- a/library/Class/AdminVar.php
+++ b/library/Class/AdminVar.php
@@ -286,6 +286,7 @@ class Class_AdminVarLoader extends Storm_Model_Loader {
   protected function _getGlobalVars() {
     return [
             'FORCE_HTTPS' => Class_AdminVar_Meta::newOnOff($this->_('Forcer l\'accès au site par le protocole HTTPS. Nécessite l\'installation et la configuration appropriée du serveur Web')),
+            'OAUTH_ACCEPT_HTTP' => Class_AdminVar_Meta::newOnOff($this->_('Autoriser l\'accès aux API OAUTH via HTTP (non sécurisé - déconseillé)')),
             'NB_AFFICH_AVIS_PAR_AUTEUR'  => Class_AdminVar_Meta::newDefault($this->_('Nombre d\'avis maximum à afficher par utilisateur.')),
             'CLEF_GOOGLE_MAP' => Class_AdminVar_Meta::newDefault($this->_('Clef d\'activation pour le plan d\'accès google map. <a target="_blank" href="http://code.google.com/apis/maps/signup.html">Obtenir la clé google map</a>')),
             'REGISTER_OK' => Class_AdminVar_Meta::newEncodedData($this->_('Texte visible par l\'internaute après son inscription.')),
diff --git a/tests/scenarios/MobileApplication/UserAccountTest.php b/tests/scenarios/MobileApplication/UserAccountTest.php
index 82523fc8b238d5121707204fcc25eca3a003c161..1c65ff57a6413a854845960cd8f4f30a742dfc9b 100644
--- a/tests/scenarios/MobileApplication/UserAccountTest.php
+++ b/tests/scenarios/MobileApplication/UserAccountTest.php
@@ -176,7 +176,7 @@ class Scenario_MobileApplication_UserAccountWithoutTokenTest extends Scenario_Mo
 
 
   /** @test */
-  public function withoutHttpsShouldAnswerInvalidRequest() {
+  public function withoutHttpsShouldAnswerValidRequest() {
     unset($_SERVER['HTTPS']);
 
     $this->dispatch('/api/user/loans',
@@ -188,6 +188,26 @@ class Scenario_MobileApplication_UserAccountWithoutTokenTest extends Scenario_Mo
                          'message' => 'Protocole HTTP obligatoire'],
                         json_decode($this->_response->getBody(), true));
   }
+
+
+  /** @test */
+  public function withoutHttpsAndOAUTHAcceptInsecureShouldAnswerLoans() {
+    unset($_SERVER['HTTPS']);
+    Class_AdminVar::set('OAUTH_ACCEPT_HTTP', 1);
+    $this->dispatch('/api/user/loans',
+                    true,
+                    ["Authorization" => "Bearer nonos" ,
+                     "Content-Type" => "application/json"]);
+
+    $loans = json_decode($this->_response->getBody(), true);
+    $this->assertEquals(['title' => 'Potter',
+                         'author' => 'J.K.R',
+                         'date_due' => '1974-01-01',
+                         'loaned_by' => 'puppy',
+                         'library' => 'Annecy'
+                         ],
+                        $loans['loans'][0]);
+  }
 }