GraphQL security is broader than authentication. A secure API must determine who the caller is, what they are allowed to access, how expensive their requested operation is, and what information should be exposed.

Because clients can construct queries dynamically, GraphQL servers must validate both the structure and the authorization implications of requested operations.