Authentication

You can use standard Laravel mechanisms (opens new window) to authenticate users of your GraphQL API. Stateless guards are recommended for most use cases.

Get the current user

Lighthouse provides a really simple way to fetch the information of the currently authenticated user. Just add a field that returns your User type and decorate it with the @auth directive.

type Query {
  me: User @auth
}

Sending the following query will return the authenticated user's info or null if the request is not authenticated.

{
  me {
    name
    email
  }
}

Apply auth middleware

Lighthouse allows you to configure global middleware that is run for every request to your endpoint, but also define it on a per-field basis.

Use the @middleware directive to apply Laravel middleware, such as the auth middleware, to selected fields of your GraphQL endpoint.

type Query {
  users: [User!]! @middleware(checks: ["auth:api", "custom"]) @all
}

If you need to apply middleware to a group of fields, you can put @middleware on an Object type.

extend type Query @middleware(checks: ["auth:admin"]) {
  adminInfo: Secrets
  nukeCodes: [NukeCode!]!
}