# Client Side Token

**URL:** <https://discuss.dgraph.io/t/client-side-token/11573>\
**Category:** Dgraph Cloud / Slash GraphQL\
**Tags:** auth\
**Created:** [November 22, 2020, 3:48am UTC](https://discuss.dgraph.io/t/client-side-token/11573 "2020-11-22T03:48:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [November 22, 2020, 3:48am UTC](https://discuss.dgraph.io/t/client-side-token/11573/1 "2020-11-22T03:48:18Z")

</div>

“All the APIs documented here require an API token for access.” - This does not seem to be true. [https://dgraph.io/docs/slash-graphql/admin/authentication/](https://dgraph.io/docs/slash-graphql/admin/authentication/)

I have no problems connecting to Slash Dgraph via Apollo (Angular or React). I have created an authentication token, but how do I prevent someone without it from connecting?

Thanks,  
J

---

<div class="post-metadata">

**Author:** ![amaster507](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/amaster507/32/4123_2.png) [@amaster507](https://discuss.dgraph.io/u/amaster507)\
**Post date:** [November 22, 2020, 3:58am UTC](https://discuss.dgraph.io/t/client-side-token/11573/2 "2020-11-22T03:58:11Z")

</div>

This should be clarified. The “APIs documented here” should specifically state that it is referring to the API endpoints listed on THIS page: `/admin`

This can be seen in the last example on the page:

> ```auto
> curl 'https://<your-backend>/admin' \
> -H 'X-Auth-Token: <your-token>' \
> -H 'Content-Type: application/json' \
> --data-binary '{"query":"{ getGQLSchema { schema } }"}'
> 
> ```

I believe this wording is due to conflicting changes where multiple endpoints have been combined into the admin endpoint. I think @acarey or @damian might be the right people to tag to review this.

If you are specifically needing to add API token access to the `/graphql` endpoint then you should look at the `@auth` directive. If you have a use case for blocking all access to the `/graphql` endpoint beyond what is capable with `@auth`, then this might be able to be turned into a feature request instead.