How does Qdrant secure access to its REST and gRPC APIs by default, and what must you configure to enable it?

The trade-off is operational simplicity against security. Leaving authentication off makes local development and quick prototyping easy, but it means an instance exposed to a network is fully open - anyone can read, write, or delete all data. The common mistake is deploying a self-hosted Qdrant instance to a cloud VM or a Kubernetes cluster without setting an API key, relying on the network perimeter for protection. Security researchers have found significant percentages of publicly reachable vector database instances running without authentication, and Qdrant is among the engines with this pattern[reference:7]. The second mistake is enabling the API key but not TLS, which protects against casual access but not against anyone who can sniff network traffic. The third mistake is binding to 0.0.0.0 and relying solely on firewall rules, which fails if the firewall is misconfigured. The alternative to Qdrant's built-in authentication is to put the instance behind a reverse proxy or API gateway that handles authentication, which is a valid pattern but adds a component to the architecture. Version note: the configuration format and the available authentication options have changed across releases - API key support was added in 1.2, and JWT RBAC in 1.9 - so verify the exact configuration on your version.

Version-dependent: API key authentication requires Qdrant 1.2 or later, and TLS requires 1.2 or later as well. Granular access API keys using JWT require 1.9 or later[reference:8]. The configuration format (YAML keys and environment variable names) has been stable across recent releases, but the set of available security features has expanded. Qdrant Cloud enables authentication and TLS by default, so the self-hosted configuration described here does not apply to Cloud deployments.