Operator API Keys

Authenticate the Apollo GraphOS Operator to GraphOS

An Operator API key is used for the Apollo GraphOS Operator. It is a special organization-scoped service account key (not tied to an individual user) that the Operator uses to publish subgraph schemas, fetch composed supergraph schemas, and manage graph API keys for router deployments.

Create an Operator API key

Creating an Operator API key requires Org Admin privileges in GraphOS.

Find your organization ID under the Organization tab in Studio.

Run the following Rover CLI command:

Bash
1rover api-key create <ORGANIZATION_ID> operator <KEY_NAME>

The key is created at the organization level, not the graph level.

Operator API key capabilities

An Operator API key enables the following operations against the Apollo GraphOS Platform API:

Write operations:

  • Publish subgraph schemas to trigger composition (PublishSubgraphs)

  • Remove a subgraph from the supergraph (DeleteSubgraph)

  • Delete a graph variant (DeleteVariant)

  • Create graph API keys for Supergraph resources (CreateApiKey)

  • Delete graph API keys for Supergraph resources (DeleteApiKey)

Read operations:

  • Fetch graph variants for a given graph (GetGraphVariants)

  • Fetch a schema by launch ID (GetSchema)

  • Fetch the latest approved schema (GetLatestSchema)

  • Fetch inputs for the latest composition (GetLatestSchemaInputs)

  • Poll composition status (GetCompositionResult)

  • List graph API key metadata (ListApiKeyMetadata)

  • Validate key type on startup (GetServiceAccount)

An Operator API key can't:

  • Manage billing or subscription settings

  • Invite or remove organization members

  • Modify user roles or permissions

  • Access any graph or variant outside the operations already listed

For an overview of all key types, see API Keys.
Feedback

Ask Community