Block API access

kentdavies · May 29, 2025, 2:42pm

I have…

Read the following guideline: https://docs.squidex.io/01-getting-started/installation/troubleshooting-and-support. I understand that my support request might get deleted if I do not follow the guideline.
Used code blocks with ``` to format my code examples like JSON or logs properly.

I’m submitting a…

Regression (a behavior that stopped working in a new release)
Bug report
Performance issue
Documentation issue or request

Current behavior

Hello,

I’m trying to manage API access permissions but running into some issues.

In Settings > Clients, I have a “default” client with the “Owner” role and “Allow anonymous access” enabled.

If I access https://www.mysite.com/api/content/myapp/newsletter in the browser, it returns a JSON with the list of subscribed emails.

I want this endpoint to be accessible only to specific users (ideally via token authentication), and not publicly available.

I created a role (“Test_API”) with only contents.*.read and assets.read permissions, and with “Hide API” checked. I also set this as the default app role, but the endpoint still returns data when accessed directly in the browser.

Is there a way to block public access entirely and require authentication (e.g., via Postman) to access this API?

Thanks.

Expected behavior

Minimal reproduction of the problem

Environment

App Name:

Self hosted with docker
Self hosted with IIS
Self hosted with other version
Cloud version

Version: [VERSION]

Browser:

Chrome (desktop)
Chrome (Android)
Chrome (iOS)
Firefox
Safari (desktop)
Safari (iOS)
IE
Edge

Others:

Sebastian · May 30, 2025, 6:27am

Just uncheck “Allow anonymous access”

kentdavies · May 30, 2025, 7:52am

@Sebastian Thanks but if I do that, the website becomes unavailable for all clients.

Don’t know if this is what is expected or if it is something related how I’ve set the roles.

Sebastian · May 30, 2025, 7:55am

What you should do:

Have on client with minimum permissions (e.g. read) and set Allow-Anonymous to true. Then you can read your content via the API from public sources (and the browser is also public)
Set “Allow-Anonymous” to false for all other clients.

Allow anoymous means that you do not need a token to access it, so use it carefully. If you need more control which data can be accessed you need a proxy between your browser and Squidex to actually make the requests andd handle permissions and so on.