# Authentication - Slash graphql

**URL:** <https://discuss.dgraph.io/t/authentication-slash-graphql/9859>\
**Category:** Documentation\
**Created:** [August 28, 2020, 10:05pm UTC](https://discuss.dgraph.io/t/authentication-slash-graphql/9859 "2020-08-28T22:05:08Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![gja](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gja/32/2654_2.png) [@gja](https://discuss.dgraph.io/u/gja)\
**Post date:** [February 5, 2021, 3:40am UTC](https://discuss.dgraph.io/t/authentication-slash-graphql/9859/3 "2021-02-05T03:40:53Z")

</div>

Hello,

Thanks for the question.

The client key is required when using the non-graphql endpoints, such as DQL’s /query, /mutate or the gRPC endpoints with a Dgraph client such as dgo.

DQL queries do not honor any `@auth` rules specified in your GraphQL schema, and hence access to these APIs require this extra layer of security.

We are also building out a simple way to lock down your GraphQL endpoint, and only allow anonymous access to certain operations, and this should go live in a month or so (End Feb 2021).

Tejas

---

_[View the full topic](https://discuss.dgraph.io/t/authentication-slash-graphql/9859)._