[question]: Is Playground API intentionally open without authentication?

[merajalamwork-hue]

Hi AutoMQ team,

While performing API testing on the Playground
environment (playground.automq.cloud), I noticed
that the following endpoint returns 200 OK
regardless of authentication credentials:

GET /api/v1/instances

Tested scenarios:

• Valid credentials → 200 OK
• Invalid credentials (@@@@ + @@@@) → 200 OK
• No auth at all → 200 OK

Note: console.automq.cloud correctly returns
401 for unauthorized requests.

Could you confirm:

1. Is the Playground API intentionally open
   without authentication for demo purposes?
2. Or is this a security oversight that should
   be addressed?

This will help me accurately document my
findings in my QA testing report.

Thank you!
Meraj Alam

[johnluoyx]

Hi @merajalamwork-hue ,

Thank you for your careful testing and for reporting this.

The behavior on playground is expected. The Playground is intentionally designed as an open demo environment so that anyone can quickly try AutoMQ features without authentication or account setup.

All data in the Playground is mock/demo data and is fully isolated from production systems. It does not contain customer data, tenant data, or sensitive information. Therefore, some Playground APIs may return 200 OK even when no valid credentials are provided.

The production console at console.automq.cloud, however, is protected by authentication and authorization, which is why unauthorized requests correctly return 401. So this is not a security oversight, but expected behavior for the demo environment. We appreciate your attention to detail and may improve the documentation to make this clearer.

[merajalamwork-hue]

Thank you @johnluoyx for the quick and
clear explanation!

This makes complete sense. I will update
my QA testing report accordingly.

One small suggestion — I checked the
Playground documentation at
docs.automq.com and could not find any
mention that the Playground API is
intentionally open without authentication
or that all data is mock/demo only.

Adding a brief note about this in the
Playground docs would help other testers
and developers understand this behavior
immediately without needing to raise a
separate question.

Thanks again for your time!
Meraj