Option to turn off APIs

[MoSattler]

As someone who will only use the local API, the REST and GQL api really don't add any value and are an unnecessary attack vector. So it would be great to be able to turn REST and GQL off if not needed.

[DanRibbens]

GraphQL already has a flag to disable it, but we don't have the same for REST as that would break the admin panel.

If you want to completely prevent all access you could remove the server.listen() from your express app.

Does that help?

[denolfe]

Here is the Payload config snippet to disable GraphQL:

graphQL: {
  disable: true,
},

[MoSattler]

it does help, thank you

[jmikrut]

You can also initialize Payload as local-only by passing local: true to payload.init. But there will be no admin UI either in that case.

[MoSattler]

My use case is essentially using payload with remix (using this template).
So while I need the admin UI, I do not need the GQL nor the REST endpoints.