How can we add the header parameters in graphql (altair) with authorisation token like postman.

In magento2 we have an option in admin system->intergration and we can the add new integration it will generate life time access token for accessing the magento2 data.

So,We need to restrict without this integration access token in headers parameter we don't allow the data by graphql.

How can we do this?

2 Answers 2


For Authorisation, You need to follow the below steps.

Step 1 : Generate Customer Token : The generateCustomerToken mutation requires the customer email address and password in the payload, as shown in the following example.

By default, a customer token is valid for 1 hour. You can change these values from Admin by selecting Stores > Settings > Configuration > Services > OAuth > Access Token Expiration > Customer Token Lifetime.

//Mutation for Generate Customer Token
mutation {
  generateCustomerToken(email: "[email protected]", password: "yourpassword") {

//Response of Generate Customer Token.
  "data": {
    "generateCustomerToken": {
      "token": "eyJraWQiOiIxIiwiYWxnIjoiSFMyNTYifQ.eyJ1aWQiOjIsInV0eXBpZCI6MywiaWF0IjoxNjc2MzU4MTc0LCJleHAiOjE2NzYzNjE3NzR9.RZqhl468dt1KinPduhKbbfHdeE8Xo1hpEMAP5Trl8RE"

Screenshot of Generate Customer Token Graphql API enter image description here

Step 2 : Set Authorisation in the headers for GraphQL API. Please follow the below Altair screenshots for the same.

Hover on an icon, Which shows the set header option, Click on that. Find the below screenshot for the same. enter image description here

Please note Add Key as Authorization & Value as Bearer & token. Provide space between Bearer & Tocken. Select the Checkbox and finally click on the Save button. Please check the below screenshot for the same. enter image description here

Finally, You can access any API using this customer token. You can now use this token in the Authorization request header field for any queries and mutations. Find the below all customer detail API screenshots for your reference.

enter image description here

Refer to Official Magento Docs for more details about GraphQL Authorization Token.

  • Thank you for reply.But here my question is how can we restrict the graphql query without authorisation token. In rest API we are using <resources> <resource ref="Magento_Catalog::products" /> </resources> without authorisation token rest API throws an error.So we ned the same conept in graphql also.How can we do this? Feb 14 at 8:53
  • You have asked two questions, First how we can set the Authorization in Altair Extension? So, I have provided the answer to that. In the second question, You are asking about restricting Graphql API for which I don't have an exact idea. Feb 14 at 9:07

We can customise logic and we can restrict but if we are using the authorisation Graphql will not cacheble. If you want please use below logic

protected $tokenModelFactory;
protected $requestInterface;

public function __construct(

\Magento\Framework\App\RequestInterface $requestInterface,
\Magento\Integration\Model\Oauth\TokenFactory $tokenModelFactory,
  $this->requestInterface = $requestInterface;
  $this->tokenModelFactory = $tokenModelFactory;

 public function resolve(
        Field $field,
        ResolveInfo $info,
        array $value = null,
        array $args = null
)   {
      $authorization = '';
      $headers = $this->requestInterface->getHeader('Authorization');
      if($headers == true) {
        $authorization = str_replace("Bearer ","",$headers);
     $tokenCollection = $this->tokenModelFactory->create()->loadByToken($authorization);
    $consumerId = $tokenCollection->getData('consumer_id');
    if($consumerId == '' || $authorization == '')  {
    throw new GraphQlAuthorizationException(__('Invalid authorization token'));

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.