How do I use OAuth with GraphQL?

OAuth and GraphQL usually work together like this:

• OAuth handles authentication/authorization: who the user is and what they’re allowed to do.
• GraphQL handles data fetching: the client sends queries/mutations to one endpoint.

The most common pattern is:

1. User signs in via an OAuth provider
2. Client receives an access token
3. Client sends that token with GraphQL requests
4. GraphQL server validates the token and uses the user’s identity/roles to authorize field access and mutations

Typical flow

1) Use OAuth to get an access token

For example, with Google/GitHub/Auth0/etc.:

• Redirect user to the provider’s authorization page
• User approves access
• Your app gets an authorization code
• Exchange code for an access token
• Store the token securely

For browser apps, the recommended flow is usually Authorization Code Flow with PKCE.

2) Send the token to the GraphQL API

Include the token in the Authorization header:

Authorization: Bearer <access_token>

Example GraphQL request:

POST /graphql
Authorization: Bearer eyJhbGciOi...
Content-Type: application/json

{
  "query": "{ me { id name } }"
}

3) Verify the token on the server

Your GraphQL server should:

• validate the token signature
• check expiration
• extract user info/claims
• attach the user to the GraphQL context

Then resolvers can use context.user (or similar) for authorization.

Example server-side idea

Express + Apollo Server style

const server = new ApolloServer({
  typeDefs,
  resolvers,
});

const app = express();

app.use(async (req, res, next) => {
  const auth = req.headers.authorization || "";
  const token = auth.startsWith("Bearer ") ? auth.slice(7) : null;

  if (token) {
    req.user = await verifyToken(token); // validate JWT / introspect token
  }

  next();
});

server.applyMiddleware({ app, context: ({ req }) => ({ user: req.user }) });

Then in resolvers:

const resolvers = {
  Query: {
    me: (parent, args, context) => {
      if (!context.user) throw new Error("Unauthorized");
      return getUserById(context.user.sub);
    },
  },
};

Important design choices

JWT vs opaque token

OAuth access tokens may be:

• JWTs: can be validated locally by checking signature
• Opaque tokens: must be checked by calling the OAuth provider’s introspection endpoint

Authentication vs authorization

• Authentication: “Who is this?”
• Authorization: “What can they access?”

In GraphQL, you often enforce authorization:

• at the field level
• at the resolver level
• using schema directives
• or with a policy layer

Best practices

• Use HTTPS
• Prefer Authorization Code + PKCE for public clients
• Don’t put tokens in GraphQL query variables or the request body
• Keep access tokens short-lived
• Use refresh tokens only where appropriate
• Validate authorization in resolvers, not just at login
• Don’t rely on GraphQL hiding fields; always enforce permissions server-side

Common architecture

• Frontend logs in with OAuth provider
• Backend validates OAuth token
• GraphQL API trusts backend-issued or provider-issued access token
• Resolvers check user identity and permissions

If you’re using GraphQL subscriptions

You’ll usually pass the token when opening the WebSocket connection and authenticate there too.

If you want, I can show:

1. a React + Apollo Client example,
2. a Node/Apollo Server example,
3. or how to do this with a specific provider like Auth0, Google, or GitHub.