GraphQL API

Openfront's Keystone layer exposes GraphQL at /api/graphql. The schema is generated from features/keystone/models and the registered custom mutations in features/keystone/mutations.

Session and bearer authentication

Dashboard requests use the application session. Current source also contains API-key and OAuth bearer-token handling. API keys have hashed secret material, status/expiry fields, optional IP restrictions and scope data.

Before relying on bearer scopes, test that each resolver and custom operation enforces the expected scope and tenant/ownership boundary. A scope value stored on a key does not protect an operation unless the operation checks it.

Query published products

The generated schema uses title, handle, status, productVariants, productImages, and productCategories:

query PublishedProducts {
  products(where: { status: { equals: published } }) {
    id
    title
    handle
    thumbnail
    status
    productVariants {
      id
      title
      sku
    }
    productImages {
      id
      image {
        url
      }
      imagePath
      altText
    }
    productCategories {
      id
      title
      handle
    }
  }
}

Run queries against your own origin:

curl https://your-openfront.example/api/graphql \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_KEY' \
  --data '{"query":"query { products(take: 1) { id title handle } }"}'

Use a key with only the scope needed for the operation. Keep it out of shell history and logs.

Custom operations

Checkout, carts, payments, fulfillment, OAuth, apps and other high-value workflows use custom GraphQL operations in addition to generated list CRUD. Read the registered source and generated schema for exact names and inputs. Prefer those domain operations when they enforce ownership, snapshots, idempotency and lifecycle checks.

Generated CRUD is not automatically a safe public storefront API. Verify anonymous, wrong-user, wrong-store, expired-key, missing-scope and replay cases before exposing any operation.

Schema visualizer

The schema visualizer can help with relationships. The generated schema.graphql remains the authoritative API artifact for a source revision.