Are you using https://play.dgraph.io/?
In “Extra Settings” are you using Slash API Key?
Are you using ACL?