Persisted queries — reduce payload size and lock down allowed operations

GraphQL queries sent over the wire can be large strings. Every request includes the full query text, wasting bandwidth. Additionally, accepting arbitrary queries from untrusted clients is a security risk in production.

Use Automatic Persisted Queries (APQ) for bandwidth savings, or full persisted queries for operation whitelisting.

// Apollo Client — APQ (client sends hash, server fetches query if unknown)
import { createPersistedQueryLink } from '@apollo/client/link/persisted-queries';
import { sha256 } from 'crypto-hash';

const link = createPersistedQueryLink({ sha256 }).concat(httpLink);

// Server — full persisted query manifest (operations only from known hash)
// Using @apollo/server persisted queries plugin
import { createPersistedQueryManifestPlugin } from '@apollo/server-plugin-operation-registry';

APQ: on cache miss, client resends with full query; server caches by hash. Subsequent requests send only the hash (~50 bytes). Full persisted queries reject unknown hashes, blocking schema introspection abuse and arbitrary queries.

Production GraphQL APIs, especially mobile-backed or high-traffic APIs