---
title: Basic authentication from back end
slug: graph/docs/basic-authentication-from-back-end
docTags: 
createdAt: 2026-07-30T20:30:19.772Z
---

Configure Optimizely Graph to retrieve content from your CMS (PaaS) solution, including restricted content that requires authenticated access. Learn how to install the ContentGraph addon, configure access rights, and query content using Postman or HTTP clients.

## Prerequisites

- Optimizely Content Management System (CMS)
- Optimizely Graph addon (PaaS only)
- Postman or cURL

## CMS configuration

Configure CMS (PaaS) to expose restricted content to Optimizely Graph. The steps that follow install the addon, set the Graph credentials in your application settings, and run the synchronization job that makes content available to authenticated queries.

### Install the ContentGraph addon (PaaS only)

1. Open your Optimizely CMS solution and install the `Optimizely ContentGraph` addon.

```shell
dotnet add Optimizely.ContentGraph.Cms
```

2. Update the `appsettings.json` file with the values provided by the Optimizely Support team.

```json
"Optimizely": {
    "ContentGraph": {
      "GatewayAddress": "",
      "AppKey": "",
      "Secret": "",
      "SingleKey": "",
      "AllowSendingLog": "true",
      "ContentVersionSyncMode": "All",
      "SyncReferencingContents": "true",
      "EnablePreviewTokens": "true"
    }
  },
```

### Configure access rights and run the synchronization job

1. Set access rights for content.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/N4LGNLLhvI44pXl-7rrTh_b7362e5-image.png)

2. Run the website.
3. Run the `Optimizely Graph content synchronization job`.
4. Wait for the job to finish. Restricted content is accessible only after the job finishes.

## Retrieve restricted content

Choose the client that matches your workflow to query restricted content. Postman gives you a UI for exploring the collection, while raw HTTP suits scripted or server-to-server requests.

### Query restricted content with Postman

1. Import [https://cg.optimizely.com/app/swagger/swagger.json](https://cg.optimizely.com/app/swagger/swagger.json) to a Postman collection.
2. Configure the following variables for the collection:
   - **baseUrl** – `https://cg.optimizely.com`.
   - **appKey** – `AppKey` value (same as the previous step).
   - **appSecret** – `Secret` value (same as the previous step).

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/7qUOWRRXfJemL7Hnko7YB_a58fda2-image.png)

3. Configure the **Authentication** method to `Basic`. Enter your `appKey` as `Username` and `appSecret` as `Password`.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/WhZDyMHh34kzC_pbG5rl0_867ec4c-image.png)

4. Query restricted content items with the following headers: `cg-username` and `cg-roles`.

:::hint{type="info"}
- **Note**
  **cg-username** – Optimizely CMS user.
- **cg-roles** – Optimizely CMS roles to access specific content items.
:::

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/UnuHDqVpoOowWZz0BffVI_b80d069858d01a7fdf46cc6e63ee6d41fba0a11a6fb4b33238ae0020cd52145d-image.png)

### Query restricted content over HTTP

Use raw HTTP when you call the Graph endpoint from server code or a scripted client. Send a `POST` to the Graph content endpoint with a basic-auth header and the `cg-roles` header that names the CMS roles allowed to read the content.

```http
POST {{graphDomain}}/content/v2
Content-Type: application/json
Authorization: Basic {{graphBase64EncodedToken}}
cg-roles: Administrators
{ "query" :"query { ProductPage { total } }" }
```