Is it a good to write an app that accepts sql at an authenticated endpoint?

No. That's the safe, short answer.

Are your customers actually writing SQL for executing against a database or is your app generating SQL? If instead the app's purpose is to provide a "power interface" to access data (read only?) and generate SQL, there are better choices. Use https query parameters to map to parameterized queries (https://blog.codinghorror.com/give-me-parameterized-sql-or-g...) which are a much better design choice.

I wouldn't write an 'app' that accepts SQL, but I've given out database access to clients who had software developers on-staff. It's a quick way to give access to data, and you can use permissions to restrict them. You'll want to give them their own private database.

I wouldn't give out general access to a database to the wider internet. There are plenty of ways to cause trouble even with read-only access. Transactions and expensive queries are the first ones that come to mind.

Where can it go wrong? Just about anywhere, through malice or ignorance.

If you provide the users with restricted DB access privileges, maybe.

Im writing an app that customers will use. Will it be a good idea to write an app that accepts sql queries directly in the request payload. But these endpoints have authentications too. Where it can possibly go wrong?

Curious what problem it solves.

What happens when they miss a where clause?:

delete from table foo