Make api explorer private

Question

Is it possible to either turn off the api explorer completely or limit the access to it?

I noticed some logs in my app that come from failed requests executed from a browser. My api is only consumed by an Android app so the only place where they can come from is the api explorer. Also the api access is limited to 1 web and 1 android client id.

Answer 1

Unfortunately no. The API explorer works by using the Discovery Service associated with your API, which is not actually part of your backend, so you can't specify auth or visibility for those URIs.

The list method from the Discovery service is used to generate the list on the APIs Explorer app using your app as base:

discovery.apis.list:

your-app-id.appspot.com/_ah/api/discovery/v1/apis

When someone clicks one of the APIs from the list, the full discovery document is retrieved for that apiName and apiVersion using the getRest method from the Discovery service:

discovery.apis.getRest:

your-app-id.appspot.com/_ah/api/discovery/v1/apis/{apiName}/{apiVersion}/rest

Answer 2

If you are looking for ways to prevent the executing of the API, check out Cloud Endpoints: Control who can execute API through API Explorer