What's the recommended approach for securing GraphQL APIs?

Backend Developer Forum Backend Questions/Help
, , ,
1

Hi, I’m building an application that will have support for both the web and mobile. At this time, I’m using PhxGenAuth for authentication on the web. However, it appears that there’s no out-of-the-box support for API authentication.

Thus, I was wondering, what’s the recommended approach for securing GraphQL APIs these days? From the book “Craft GraphQL APIs in Elixir with Absinthe”, it appears that JWTs is a good solution to go with for now.

Finally, are there any recommended Hex authentication packages that support both session and API authentication?

2 Likes
2

Corresponding tweet for this thread:

Share link for this tweet.

1 Like
3

A header token or a token passed in the message directly are the two ways I most often see.

3 Likes