# Federation, API Key gated Mutations

**URL:** <https://discuss.dgraph.io/t/federation-api-key-gated-mutations/15136>\
**Category:** GraphQL\
**Created:** [July 30, 2021, 12:01am UTC](https://discuss.dgraph.io/t/federation-api-key-gated-mutations/15136 "2021-07-30T00:01:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fizzi](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/fizzi/32/8427_2.png) [@Fizzi](https://discuss.dgraph.io/u/Fizzi)\
**Post date:** [July 30, 2021, 12:01am UTC](https://discuss.dgraph.io/t/federation-api-key-gated-mutations/15136/1 "2021-07-30T00:01:45Z")

</div>

I’m looking to use DGraph as part of my Apollo Federation. I’m currently running DGraph on GKE, not using Cloud.

What I’d like is to be able to hide to add/update/delete mutations from the outside, perhaps authenticating them with an API key so they can be accessible to my backend services.

I saw this, but it seems to be only referring to cloud: [https://dgraph.io/docs/cloud/admin/authentication/](https://dgraph.io/docs/cloud/admin/authentication/)

What is the best way to accomplish what I’m looking for?

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [July 30, 2021, 12:10am UTC](https://discuss.dgraph.io/t/federation-api-key-gated-mutations/15136/2 "2021-07-30T00:10:25Z")

</div>

**Update** - So I didn’t read your entire post when I responded, but I am assuming if you’re not using the dgraph graphql which is part of dgraph cloud, you’re going to have to create your own graphql endpoints, which gets complicated to use with Apollo Federation. Basically, you start from scratch with just **dql** , someone who knows this subject better than me can respond here…

* * *

You could create an @auth directive for each node like this:

```auto
type User @auth(
    add: { rule: "{$DENIED: { eq: \"DENIED\" } }"},
    update: { rule: "{$DENIED: { eq: \"DENIED\" } }"}
    delete: { rule: "{$DENIED: { eq: \"DENIED\" } }"}
) {

```

but that could get redundant with a bunch of nodes.

The other way of course is to go to **Schema** → **Access** → **Edit Permissions** and uncheck all writes. I believe that covers everything but queries.

J

---

<div class="post-metadata">

**Author:** ![Fizzi](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/fizzi/32/8427_2.png) [@Fizzi](https://discuss.dgraph.io/u/Fizzi)\
**Post date:** [July 30, 2021, 12:27am UTC](https://discuss.dgraph.io/t/federation-api-key-gated-mutations/15136/3 "2021-07-30T00:27:35Z")

</div>

Thanks for the response.

Sounds like your second suggestion might be what I’ll look at first. I don’t want to add nodes later and forget to add the auth rules. Would this configuration be found in Ratel? I couldn’t find much about permissions in there.

Additionally, how would I go about accessing the writes from my backend in this scenario? I’d still like to be able to run the mutations but only from my backend, they should not be visible to any external clients.

To respond to your edit: I’m not sure exactly. I do have a graphql endpoint though from my GKE instance, and I was able to use `curl -X POST localhost:8080/admin/schema --data-binary '@dgraph/schema.graphql'` (after forwarding those ports) to upload my GraphQL schema just fine.

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [July 30, 2021, 12:33am UTC](https://discuss.dgraph.io/t/federation-api-key-gated-mutations/15136/4 "2021-07-30T00:33:55Z")

</div>

Someone else is going to have to chime in here.

I believe that doesn’t block any **admin** from doing any mutations, just regular users.

As far as any server questions, that is out of my depth, hence, why I use Dgraph Cloud in the first place 🙂

J