Subscription connections must be authenticated just like normal GraphQL operations. Authentication information may be supplied during the connection handshake or through the supported connection parameters of the transport library.

Authorization should also be evaluated when determining whether a client is allowed to subscribe to a particular resource. For example, a user should not receive messages from a private conversation simply because they know its ID.