# Protect GQL endpoint

**URL:** <https://discuss.dgraph.io/t/protect-gql-endpoint/10495>\
**Category:** Dgraph Cloud\
**Tags:** kind:question, dgraph\
**Created:** [September 21, 2020, 10:56am UTC](https://discuss.dgraph.io/t/protect-gql-endpoint/10495 "2020-09-21T10:56:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![spinelsun](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/spinelsun/32/4596_2.png) [@spinelsun](https://discuss.dgraph.io/u/spinelsun)\
**Post date:** [September 21, 2020, 10:56am UTC](https://discuss.dgraph.io/t/protect-gql-endpoint/10495/1 "2020-09-21T10:56:10Z")

</div>

Hi,

About the endpoint that slash expose, is it safe to give this endpoint to clients and restrict queries and muttions by `@auth` or should I have a server that expose only part of the functionality of the whole generated GQL API?  
I am asking becuse sometimes even if the user is authorized and authenticated he can create queries that are not legit by mistake or with purpose.

---

<div class="post-metadata">

**Author:** ![gja](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gja/32/2654_2.png) [@gja](https://discuss.dgraph.io/u/gja)\
**Post date:** [September 21, 2020, 1:24pm UTC](https://discuss.dgraph.io/t/protect-gql-endpoint/10495/2 "2020-09-21T13:24:53Z")

</div>

Both models work with Slash GraphQL, but we are encouraging users to expose their endpoint directly to clients. Please remember to set up auth rules that lock down any resources you don’t want to expose (remembering to block query / create / delete / update).