I have created a custom graphql APIs , I want to restrict these APIS for unwanted use , How can I restrict access to API'S

Any help is appreciated

Thank you.

  • Use customer token or any header value or custom header value.
    – Msquare
    Commented Apr 20, 2022 at 13:51
  • have u got solution?please help me Commented Feb 14, 2023 at 7:40

1 Answer 1


I check resources like this in my resolver class. You can assign certain permissions/resources for api integrations that you create in the Magento admin. They'll get an auth code/codes which are sent in headers, and that auth code has permissions to certain acl resources.

use Magento\Framework\AuthorizationInterface; 

//...create with di in construct...

//an example you could use in your methods
if (!$this->authorization->isAllowed('--RESOURCE HERE--')) {
    throw new \Magento\Framework\Webapi\Exception(__('Forbidden'), 0, 403);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.