Federated authentication in GraphQL

Introduction

Federated authentication lets users log in using accounts from other trusted services. This makes signing in easier and safer.

When you want users to log in with Google, Facebook, or other accounts instead of creating new ones.

When you want to avoid storing passwords and rely on trusted identity providers.

When building apps that need to share user identity across multiple systems.

When you want to improve user experience by reducing login steps.

When you want to centralize user authentication management.

Syntax

GraphQL

type Query {
  currentUser: User
}

type User {
  id: ID!
  name: String!
  email: String!
}

# Authentication handled outside GraphQL, e.g., via OAuth tokens passed in headers

GraphQL itself does not define authentication; it relies on external systems.

Federated authentication usually uses tokens (like OAuth) sent in request headers.

Examples

This query fetches the logged-in user's details after they authenticate via a federated provider.

GraphQL

# Example query to get current user info after federated login
query {
  currentUser {
    id
    name
    email
  }
}

The OAuth token from the federated provider is sent in the Authorization header for authentication.

GraphQL

# Example of sending OAuth token in HTTP header
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Sample Program

This query returns the current user's ID, name, and email after successful federated authentication.

GraphQL

# Query to get current user info
query {
  currentUser {
    id
    name
    email
  }
}

Important Notes

Federated authentication is handled outside GraphQL, often by middleware or API gateways.

GraphQL queries use the authentication info to return data for the logged-in user.

Always secure tokens and never expose them in client-side code.

Summary

Federated authentication lets users sign in using trusted external accounts.

GraphQL queries use tokens from federated login to identify users.

This improves security and user experience by avoiding password management.