I'm working on Sitecore 10.0 graphQL and trying to secure the endpoint by enabling PublicService using Authentication and Sc_api key. While applying security hardening I came across allowed controllers in system-> services-> api key. What is the purpose of Allowed Controllers and what is a best practice for graphQL to have this value. Is it fine to keep All (*) or we need specific controller to be added here as shown in below screenshot.enter image description here

1 Answer 1


You can refer to the official documentation for more detail but the long and short of it is you can create a safelist of controllers. You can use * however it is best practice to explicitly add your controllers to the list. If you have multiple controllers, you can add them to a new line and end the line with a ; character like so:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.