System vs Secured GraphQL
Editions: Open Source · Free Cloud · Pro · Workers
Apito exposes two GraphQL worlds. Mixing them is the #1 integration bug.
System GraphQL
| Path | /system/graphql (host may vary) |
| Who | Console, CLI, MCP platform tools |
| Auth | Console session / sync keys / system tokens |
| Ops | Projects, schema drafts, platform catalogs, function metadata |
Admin SDKs for apps do not target this surface.
Secured / public project GraphQL
| Path | Project GraphQL URL from Console (secured and/or public) |
| Who | Apps, Admin SDKs, API Explorer, seed scripts |
| Auth | ak_… project keys or app-user JWTs |
| Ops | Your models: search/get/create/update/delete |
Public may further restrict mutations by RBAC / token type; treat “secured” as the authenticated app API unless your project documents an anonymous public schema.
Decision tree
Managing projects / drafts / MCP platform?
→ System GraphQL (CLI, Console, MCP)
Reading/writing business data?
→ Secured/public project GraphQL (Admin SDK or raw)