Production GraphQL services should separate application configuration from source code. Database credentials, signing keys, API tokens, and service credentials should be supplied through secure configuration mechanisms.

Secrets should never be committed to the repository or embedded in generated client bundles. Configuration should also be validated during application startup so invalid environments fail early.