Apollo GraphOS Platform
OverviewQuickstart
APIs and Tools
GraphOS Platform API

GraphOS MCP Server

InstallTools
Apollo Sandbox
Schema Management
Overview

Schema Delivery

Publishing

OverviewPublish with RoverPublish with the Platform APIGuide: Publish with GitHub Actions
Launches

Graph Artifacts

OverviewDeploy with Graph ArtifactsTagsOCI RegistrySelf-host Artifacts

Contracts

OverviewCreateUsage PatternsReference

Schema Checks

OverviewRun ChecksCustom ChecksChecks ConfigurationGitHub IntegrationChecks Reference

Schema Linting

OverviewLinter Rules

Schema Proposals

OverviewConfigureCreateReviewImplement
Explorer IDE
OverviewConnect and AuthenticateOperation CollectionsSubscription SupportEmbedScriptingAdditional Features
Graph Security
OverviewPersisted Queries
Metrics and Insights
Overview

Metrics Collection and Forwarding

Sending Metrics to GraphOSOperation SignaturesDatadog Forwarding

Insights and Analysis

Operation MetricsField UsageError DiagnosticsSubgraph MetricsSegmenting by Client

Notifications and Alerts

OverviewDaily ReportsSchema ChangesSchema ProposalsPerformance AlertsBuild Status
Access Management
Organizations

API Keys

OverviewGraph API KeysVariant API KeysSubgraph API KeysPersonal API KeysOperator API KeysManage API Keys with GraphOS StudioManage API Keys with the Platform API
Members, Roles, and PermissionsAudit Logs

SSO

OverviewMulti-Organization

SAML

OktaMicrosoft Entra IDGeneric SAML Setup

OIDC

OktaMicrosoft Entra IDGeneric OIDC Setup

SCIM

OverviewOktaMicrosoft Entra ID

OAuth

OverviewSet Up an OAuth Client
Graph Management
Using VariantsAdding SubgraphsManaging SubgraphsUpdating Graph ComponentsTransferring Graphs
Production Readiness
Production Readiness Checklist

Testing and Load Management

Overload ProtectionLoad TestingTesting with Federation

Environment and Deployment

Environment Best PracticesSchema Change ManagementUpdating Client SchemaDeployment Best Practices
Platform Limits
Products
Apollo GraphOS PlatformManage, observe, and scale your graph.GraphOS Agent ServicesPreviewGovern how agents access your graph.Apollo ConnectorsConnect REST APIs to your graph declaratively.Apollo FederationFederate multiple subgraphs into a single supergraph.Rover CLIInteract with your graph from the command line.Apollo RouterRun and configure your graph gateway.Apollo OperatorDeploy and manage Apollo Router on Kubernetes.
Open source
Apollo Client (Web)Simplify GraphQL data management in web apps.Apollo iOSSwift-first GraphQL client for iOS.Apollo KotlinKotlin-first GraphQL client for Android and JVM.Apollo ServerBuild GraphQL servers with Node.js.Apollo MCP ServerExpose GraphQL tools to AI agents with MCP.IDE SupportEnhance your development workflow with IDE support.GraphOS Router Support ToolDiagnose and troubleshoot your GraphOS Router.
Resources

OAuth Overview

Use OAuth clients for machine-to-machine access to GraphOS

PLAN REQUIRED
This feature is available on the following GraphOS plans: Standard, Enterprise.
Preview Feature

GraphOS supports the OAuth 2.1 client_credentials grant for machine-to-machine authentication. An OAuth client authenticates as itself, with no user present, and exchanges its client ID and secret for a short-lived access token.

Use OAuth clients for CI/CD pipelines and other automation that runs Rover against your graphs.

When you use OAuth clients, you can:

  • Issue short-lived access tokens that expire after 15 minutes

  • Grant access by specifying scopes and the graphs they apply to

  • Rotate the client secret with a grace period so running pipelines don't break during rotation

Supported scopes

Scopes define what the client can do on the graphs you grant it access to.

GraphOS currently supports the following scopes for OAuth clients, where each scope includes all permissions of the scopes preceding it:

ScopeGrants
rover:cli:readRead schemas and contracts, for example with rover supergraph fetch or rover graph fetch.
rover:cli:writeEverything in rover:cli:read, plus running schema checks, publishing schemas, creating new variants, and publishing READMEs.
rover:cli:manageEverything in rover:cli:write, plus managing variants and contract configuration, including deletion.

Always use the narrowest scope that covers your workflow. For example, a pipeline that runs checks and publishes subgraph schemas should use rover:cli:write instead of rover:cli:manage.

note
The rover:cli scope is a deprecated alias of rover:cli:manage. Use rover:cli:manage for new clients.

Access tokens

Access tokens expire after 15 minutes. The client_credentials grant doesn't issue refresh tokens, so automation requests a new token at the start of each job, or whenever the current one expires.

An access token always has the permissions of the scopes the client was created with, and only on the graphs you granted the client access to.

Requirements

OAuth clients have the following requirements:

note
Creating, rotating, or deleting a client on any other plan fails with the error Organization's plan does not support client_credentials OAuth client registration.

Setup instructions

To create an OAuth client, request access tokens, and manage the client over its lifetime, follow the OAuth client setup guide.

Best practices

  • Create one client per workflow.

  • Grant each client the narrowest scope and fewest graphs. A client that only runs checks on one graph shouldn't have rover:cli:manage on every graph.

  • Set a secret lifetime that matches your rotation policy. For example, if you rotate quarterly, set secretLifetimeDays to 90 or slightly more.

  • Store secrets in a secret manager. Never commit a client secret to source control or print it in CI logs.

  • Request a new access token at the start of each CI/CD job. Tokens expire after 15 minutes, so don't store or reuse them between jobs.