maticzav/graphql-shield

Health v2 · maintenance only

Adoption not part of the score

3578 stars · 188 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

GraphQL Shield is a TypeScript library that lets you build a permission layer for GraphQL servers using an intuitive rule-based API. It works with any GraphQL server via GraphQL Middleware and includes a caching shield engine to keep request overhead low.

Use cases

• add role-based permissions to a GraphQL API
• restrict access to specific GraphQL fields or types
• hide internal data from unauthorized GraphQL queries
• write reusable authorization rules for Apollo Server
• prevent unauthorized resolvers from executing in GraphQL Yoga
• cache permission checks to speed up GraphQL requests

When to choose

• you need per-field or per-type authorization in a GraphQL schema
• you want a declarative, rule-based permission layer instead of ad-hoc resolver checks
• you use Apollo Server, GraphQL Yoga, or another middleware-compatible GraphQL server
• you want cached permission evaluation to minimize request overhead

When to avoid

• your API is REST or otherwise not GraphQL-based
• you need authorization enforced at the database or service layer rather than the GraphQL layer
• your project is not on Node.js/TypeScript
• you need very complex, dynamic policies better suited to a policy engine like OPA or Casbin

Facets

library · maturity stable

authorization middleware graphql security web-development backend apis security graphql-middleware permissions rule-based apollo-server graphql-yoga permission-layer nodejs typescript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="maticzav/graphql-shield")