Configure Public API Authorization Strategies
masterThe plugin's Public API (REST and GraphQL) can be secured using two different strategies via Settings -> Users & Permissions Plugin -> Roles:
User-based Authorization
- Public: The default role for unauthenticated users. Enabling the plugin API here makes it fully public with no permission checks.
- Authenticated: The default role for Strapi Users. Requires a
Bearer <token>for all calls.
Token-based Authorization
- Full Access: Provides full access to all Strapi Content APIs and plugin endpoints.
- Custom (Recommended): Allows granular access management for both Strapi Content API endpoints and the plugin's Public API.
Note on Read-Only Tokens:
Strapi's standard Read-Only tokens only support find and findAll endpoints for Content APIs. They do not cover the plugin's Public API render and renderChild endpoints. For secured access to these endpoints, use a Custom token type.