The GraphQL API operates over HTTP, which means that you can access your
exposed data using any HTTP or GraphQL client.
Realm enforces rules for all GraphQL operations, so any GraphQL HTTP request
must include an application user's login credentials or a valid access token.
Authorization Header
To authenticate a GraphQL request as an arbitrary logged in user from any
provider, include a valid user access token as a bearer token in the request's
Authorization header:
"body": '{"query":"query AllMovies {\n movies {\n title\n year\n }\n}"}'
})
curl --location --request POST 'https://realm.mongodb.com/api/client/v2.0/app/<yourappid-abcde>/graphql' \
--header 'Authorization: Bearer <Access Token>' \
--header 'Content-Type: application/json' \
--data-raw '{"query":"query AllMovies {\n movies {\n title\n year\n }\n}"}'
Credential Headers
Important
Credential headers are useful for infrequent or test requests. However, we
strongly encourage you to authenticate GraphQL requests using
an Authorization Header from a
client that uses a Realm SDK.
GraphQL requests from a web browser must use an Authorization header to
avoid CORS errors.
Email/Password
To authenticate a GraphQL request as an email/password user, include the user's credentials in the
request's email and password headers:
