# Why You Should Disable GraphQL Introspection In Production - GraphQL Security

DevFeed: [Why You Should Disable GraphQL Introspection In Production - GraphQL Security](<https://devfeed.tech/articles/why-you-should-disable-graphql-introspection-in-production-graphql-security-23602.md>)

Original publisher: [Read original article](<https://www.apollographql.com/blog/why-you-should-disable-graphql-introspection-in-production>)

Author: Khalil Stemmler

Published: 2021-05-07T11:48:47Z

Content type: tutorial

Language: en

Sources: [Apollo Blog](<https://devfeed.tech/sources/apollo-blog.md>)

Topics: [GraphQL](<https://devfeed.tech/topics/graphql.md>), [Security](<https://devfeed.tech/topics/security.md>), [API](<https://devfeed.tech/topics/api.md>), [Postman](<https://devfeed.tech/topics/postman.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [postman](<https://devfeed.tech/tags/postman.md>), [production](<https://devfeed.tech/tags/production.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article argues that GraphQL introspection should generally be disabled in production, especially for private APIs, to reduce security exposure. It explains introspection's role in development and proposes using a schema registry to retain similar benefits.

## Source excerpt

Once your graph is up and running in production, like anything else on the internet, it's a good idea to implement precautions to prevent it from being compromised by bad actors. Disabling introspection in production is a widely debated topic, but we believe it's one of the first things you can do to harden your GraphQL API in production.