I don't know what the stack you're working with looks like, but authentication can be done the same way as a REST API would - wherever you have your top-level h

I don't know what the stack you're working with looks like, but authentication can be done the same way as a REST API would - wherever you have your top-level handler that receives the HTTP request can accept/reject the request if it is invalid. So for example, you'd use the same express middleware you would normally if that was your stack. Its a bit simpler to wrap your head around from that perspective if you just think of it as any other POST request. Authorization, that is, allowing users access to some things but not others, is more complicated and of course bespoke to your application. The simple solution is to simply check context in individual resolvers, which ends up looking a lot like a normal Express/Flask/Sinatra app. There is a graphql-middleware package that helps structure "middleware" resolvers, and a graphql-shield package that helps with more complicated role-based logic.