Introduction

Our API provides a comprehensive authentication system built on Apollo GraphQL and Express. It offers secure user management capabilities with JWT-based authentication and secure token refresh mechanisms.

The GraphQL Auth API is designed to be a complete solution for user authentication in modern web and mobile applications. It handles user registration, authentication, token management, and user data operations through a clean GraphQL interface.

Authentication

To use this API, you'll need to follow these steps to authenticate your requests:

1. Obtain Client Credentials

   Contact our team to receive a client ID and public key. These credentials are essential for accessing our API and ensuring secure communications.

2. Include Headers in Requests

   All requests to the API must include the following header:

   Required Headers Copy Copied!

   client_id: YOUR_CLIENT_ID

3. Decrypt Data

   Use your provided public key to decrypt sensitive data and tokens returned by the API. This ensures that your authentication tokens remain secure during transmission.

   Once you've obtained a JWT token from the signIn or signUp mutations, you should include it in subsequent requests that require authentication:

   Authorization Header Copy Copied!

   Authorization: Bearer YOUR_JWT_TOKEN

Token Lifecycle

Our authentication system uses JWT (JSON Web Tokens) with the following characteristics:

• Access tokens have a limited lifespan (typically 1 hour)
• Refresh tokens can be used to obtain new access tokens
• Tokens contain encoded user information for stateless authentication

GraphQL Endpoint

All GraphQL operations are performed through a single endpoint:

POST https://central-auth-service.vercel.app/api

The API uses Apollo Server middleware to process GraphQL requests. All queries and mutations should be sent to this endpoint using the POST method with a JSON payload.

Request Format

GraphQL requests should be formatted as follows:

{
  "query": "query { ... }" // or "mutation { ... }"
  "variables": { } // optional variables object
}

Queries

The API provides the following query operations:

query {
  verifyToken(token: "your-jwt-token") {
    id
    email
  }
}

query {
  generateRefreshToken(token: "your-jwt-token")
}

query {
  generateToken
}

query {
  sayHello {
    message
    status
  }
}

Mutations

The API provides the following mutation operations:

mutation {
  signUp(
    email: "user@example.com", 
    password: "secure-password"
  ) {
    access_token
    refresh_token
    message
    status
    error
  }
}

mutation {
  signIn(
    email: "user@example.com", 
    password: "secure-password"
  ) {
    access_token
    refresh_token
    message
    status
    error
  }
}

mutation {
  updateUser(
    user_id: "user-id",
    token: "jwt-token",
    updated_data: {
      email: "new-email@example.com",
      password: "new-password"
    }
  ) {
    message
    status
    error
  }
}

mutation {
  deleteUser(
    user_id: "user-id",
    token: "jwt-token"
  )
}

Error Handling

The API returns standardized error responses with appropriate HTTP status codes and descriptive messages to help troubleshoot issues.

Common Error Types

Authentication errors typically include:

• Missing or invalid client ID
• Invalid or expired tokens
• Insufficient permissions
• Malformed GraphQL queries
• Validation errors in input data

Error Response Format

Error responses follow this structure:

{
  "errors": [
    {
      "message": "Error description",
      "extensions": {
        "code": "ERROR_CODE",
        "status": 400
      }
    }
  ]
}