# Public Access

## Summary

Because the **Public Access** setting bypasses authentication and authorization checks, you should enable it only for publicly exposed web services.

The **Public Access** setting instructs Pomerium to grant unauthorized and unauthenticated access to all requests to the upstream service. If you enable this setting, no other policy should be provided for the route.

By default, Pomerium serves a **robots.txt** response directly, instructing search engines *not* to crawl the route domain:

```txt
User-agent: *
Disallow: /
```

For routes with policies that allow public, unauthenticated access, Pomerium *will not* serve **robots.txt** directly. Instead, Pomerium will proxy requests for `/robots.txt` to the upstream service.

## How to configure

**Core:**

| **YAML**/**JSON** setting | **Type** | **Default** | **Usage** |
| :-- | :-- | :-- | :-- |
| `allow_public_unauthenticated_access` | `boolean` | `false` | **optional** |

### Examples

```yaml
allow_public_unauthenticated_access: true
```

**Enterprise:**

Enable **Public Access** in the **Policy Builder** in the Console:

\[Enable public access in the console]

**Kubernetes:**

| **[Annotation name](https://www.pomerium.com/docs/deploy/k8s/ingress.md#set-ingress-annotations)** | **Type** | **Default** | **Usage** |
| :-- | :-- | :-- | :-- |
| `allow_public_unauthenticated_access` | `boolean`, `string` | `false` | **optional** |

### Examples

```yaml
ingress.pomerium.io/allow_public_unauthenticated_access: 'true'
```