Dgraph cloud api security

Can’t find a way how do disable dgraph cloud graphql api without using client or admin key. Is it supported?
Not sure i can understand when we need to use generated client key if graphql api is available all the times. What particularly client key protects?