Hi @pcjun97,
Yes, dgraph endpoints are accessible by default without ACL. If you would like to lock these down to require an API key
- You could put a proxy in front of your dgraph instance and set up a proxy that prevents access without some header
- You can use Slash GraphQL, which allows you to spin up a secured, hosted instance of Dgraph, and set up API keys for access
Tejas