How do I build a GraphQL API?

Here's how to build a GraphQL API with the current (2026) stack, using Node.js and Apollo Server 5:

1. Set up the project

Create your project directory and run npm init -y Install core dependencies: npm install @apollo/server graphql Install TypeScript tooling: npm install -D typescript ts-node nodemon @types/node Apollo Server 5 requires Node.js v20.0.0 or higher (Apollo Server 4 hit end-of-life on January 26, 2026, so new projects should start on v5 directly)

2. Define your schema first

Write your schema using Schema Definition Language (SDL) — this schema-first approach lets frontend and backend teams work in parallel against a shared, self-documenting contract Define your type Query (read operations) and type Mutation (write operations) Use ID! and other non-nullable (!) types deliberately — this prevents whole classes of null-pointer errors For mutations, use a single input type (e.g., CreateUserInput) so you can add fields later without breaking existing clients

3. Write resolvers

Each schema field needs a corresponding resolver function — this is the logic layer that turns a GraphQL operation into actual data Start with hardcoded/mock data to verify wiring, then connect to a real data source (Postgres via Prisma is the common modern pairing, though MongoDB via Mongoose also works)

4. Instantiate and run the server

Create an ApolloServer instance with your schema and resolvers, then call startStandaloneServer (or integrate with Express/Fastify for a fuller framework) Test locally using Apollo Sandbox at your local endpoint, which lets you build and run queries interactively

5. Solve the N+1 problem

Use DataLoader in your context builder to batch and cache database calls per-request Critical gotcha: instantiate DataLoader fresh inside the context builder for every request — a loader cached across requests will leak one user's data into another's response

6. Add auth

JWT is the standard approach; wire it through Apollo Server's context so resolvers can check the authenticated user Remember that WebSocket subscriptions need auth handled separately — the HTTP auth token doesn't automatically apply, so read it from connectionParams in the graphql-ws context callback

7. Add real-time features (if needed)

Use graphql-ws for subscriptions — the older subscriptions-transport-ws package has been unmaintained since 2021 and causes connection instability

8. Harden for production

Set introspection: false and includeStacktraceInErrorResponses: false — Apollo Server 5 still exposes stack traces by default outside production mode Add depth-limiting and query complexity limits to block the CVE-2026-23897 class of denial-of-service attacks Enable persisted queries (Apollo Server 5 supports this natively) — essentially mandatory for consumer-facing APIs in 2026, since it eliminates arbitrary-query attack surface Enforce a maximum first argument on any list-returning field, or an attacker can request unbounded results and page your server Add codegen to CI (e.g., npm run codegen && git diff --exit-code) so resolver types never silently drift from the schema

9. Test and monitor

Test resolvers directly against the executable schema using graphql() rather than spinning up a real HTTP server — reportedly ~28x faster per test Since GraphQL exposes a single /graphql endpoint, traditional path-based REST monitoring won't work — use Apollo Studio (or GraphOS) for field-level performance metrics and query tracing