---
title: "GraphQL"
description: "57 posts about GraphQL, summarised, each linking to the original."
---

# GraphQL
> 57 posts about GraphQL, summarised, each linking to the original.

## Articles

### [Rate Limiting GraphQL APIs by Calculating Query Complexity](https://yomu.fyi/post/rate-limiting-graphql-apis-by-calculating-query-complexity.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Jun 22, 2021
- Type: Explainer

Shopify’s GraphQL Admin API uses calculated query costs to address two limitations of request-based rate limiting: identical credits for responses of different sizes and equal treatment of reads and side-effecting writes. The server statically analyzes each query, assigning one point to objects and interfaces or unions, zero to scalars and enums, two plus the requested object count to connections, and 10 to mutations. Clients receive 50 points per second up to a 1,000-point limit, while responses expose requested and actual costs; when fewer connection records are returned, the difference is refunded. The post reports a linear correlation between calculated query complexity and execution time, giving Shopify more predictable load for infrastructure scaling and a way to identify performance outliers.


### [Querying Strategies for GraphQL Clients](https://yomu.fyi/post/querying-strategies-for-graphql-clients.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Jun 15, 2021
- Type: Tutorial

GraphQL clients can face slower, larger queries and difficult roll-outs as product screens gain features and data. The Orders & Fulfillments teams examined these issues while targeting a sub-one-second mobile page load on a reliable network. Starting with a product-list query that loads 100 products, the post recommends pagination with page-size/index controls and a hasNextPage field, plus performance tripwires to track loading time. It describes @include and @skip directives, runtime query construction, and chained queries for feature flags or parameters, while warning that chained requests add latency. For growing screens, it separates unrelated filters, permissions, and banners into parallel queries, enabling independent scaling, partial rendering, and less redundant pagination work, while cautioning that server load and partial-data state require monitoring and possible refactoring.


### [Updates on Shopify's Bug Bounty Program 2021 - Shopify](https://yomu.fyi/post/updates-on-shopify-s-bug-bounty-program-2021-shopify.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Mar 11, 2021
- Type: Announcement

Shopify’s 2021 bug bounty update reviews a busier 2020 program and outlines planned improvements for hackers and internal responders. Its first virtual live hacking event brought together 38 hackers from seven countries, generated 83 valid reports, and paid more than $220,000 in bounties plus $54,000 in bonuses. Shopify also raised its maximum bounty to $50,000, surpassed $2 million in total awards, replaced its bounty table with CVSS-based scoring and a public calculator, and published a GraphQL hacking guide. To handle volume, the Application Security team created a dedicated HackerOne team, built a dashboard for follow-up questions, and planned more resources and a revised private Experiments program. In 2020, Shopify triaged 215 reports, paid over $460,000, and reported an average first-response time of 25 hours, while average triage and bounty times increased.


### [Using GraphQL for High-Performing Mobile Applications](https://yomu.fyi/post/using-graphql-for-high-performing-mobile-applications.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Jan 22, 2021
- Type: Explainer

GraphQL is presented as a way to address mobile developers’ REST API pain points, especially repeated JSON-to-model mappings and failures when server fields or types change. It provides a strongly typed, self-documented schema contract, while introspection enables tooling to generate client code and surface deprecations at compile time. The post describes mobile practices including using reusable UI-oriented fragments, aliases for readable data models, and directives that conditionally include or skip fields; Shopify uses the open-source Syrup tool to generate strongly typed Swift and Kotlin code from application queries. This flexibility shifts responsibility toward query design: Shopify calculates field costs, limits calls through a replenishing per-user cost bucket, and requires clients to consider query complexity for responsiveness and server resources. GraphQL is positioned as language-independent and suited to bandwidth, latency, and UX-sensitive clients.


### [ShipIt! Presents: A Look at Shopify's API Health Report](https://yomu.fyi/post/shipit-presents-a-look-at-shopify-s-api-health-report.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Aug 25, 2020
- Type: Explainer

On July 17, 2020, ShipIt! hosted a discussion of Shopify’s API Health Report with Shuting Chang, Robert Saunders, Karen Xie, and Vrishti Dutta. The tool was built to surface breaking changes affecting Shopify Partner apps, and the event presented its role alongside the work of the multidisciplinary team behind it. Related materials cover Shopify’s API versioning, including how Shopify manages versioning and breaking changes, plus GraphQL Admin API references, an explorer, and learning resources. The event information also directs questions about API versioning and upcoming migrations to monitored API forums, the Partner Dashboard Support Form, and ShopifyDevs on Twitter, while linking to Shopify Partners, Shopify Developers, and REST/HTTP API evolution material.


### [How We’re Solving Data Discovery Challenges at Shopify](https://yomu.fyi/post/how-we-re-solving-data-discovery-challenges-at-shopify.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Jul 21, 2020
- Type: Problem & solution

Shopify describes data discovery as a response to growing numbers of data assets and the difficulty of finding, governing, and using them across the data lifecycle. At Shopify, pre-Artifact discovery relied on people, Slack, GitHub, and job logs, while teams lacked granular ownership, change-impact visibility, and documented reporting context. They built Artifact, a search-and-browse tool backed by a centralized metadata model, ingestion jobs, Elasticsearch indexes, GraphQL APIs, and a graph database for filterable upstream and downstream lineage. Its landing page supports browsing and plain-English search, while details pages expose documentation, schema, descriptions, usage, ownership, and lineage; initial scope prioritized frequently used, high-impact, queryable assets and downstream reports and dashboards. Since launch in early 2020, weekly Data team usage exceeded 30% and monthly retention exceeded 50%, above expectations, with future work planned for additional assets, integrations, stewardship, change management, notifications, and metadata APIs.


### [Run Apollo Server Close to Your Users](https://yomu.fyi/post/run-apollo-server-close-to-your-users.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Jul 1, 2020
- Type: Tutorial

Run Apollo Server Close to Your Users presents an edge deployment pattern for GraphQL APIs. The post argues that, much like serving JavaScript and markup from a CDN, placing API servers and an application cache near users can improve application speed. Its approach combines Fly.io’s platform for running API servers close to users with a global Redis cache service, then uses Apollo Server’s cache capabilities and first-class Redis support. A demo GraphQL API built from the Open Library REST API accompanies the guide, with both a guide and source code available. The author frames the design through a newly adopted GraphQL perspective, emphasizing static typing and describing the resulting setup as CDN-like infrastructure for an API.


### [Building a GraphQL API in JavaScript](https://yomu.fyi/post/building-a-graphql-api-in-javascript.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Owen Ou
- Published: Jun 24, 2020
- Type: Tutorial

GraphQL lets API clients specify the fields they need instead of accepting a server-defined response, reducing unnecessary payload and potentially combining data from multiple stores behind one endpoint. The tutorial builds a JavaScript/Node.js implementation by loading Schema Definition Language (SDL) with graphql-tools, defining Query, User, and Address types, and connecting fields to resolver functions. Resolvers receive field arguments and can use context for authorization, illustrated by restricting address access to the current user. It also recommends keeping business logic separate from resolvers and notes that GraphQL does not eliminate database performance, caching, logging, monitoring, or versioning concerns. The discussion presents GraphQL as useful for evolving, front-end-heavy applications, while warning that its single HTTP status code and schema versioning limitations can complicate error handling and breaking changes.


### [Fly Friday - News and Tips](https://yomu.fyi/post/fly-friday-news-and-tips.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Feb 28, 2020
- Type: Announcement

This Fly weekly update collects product news, community announcements, and a flyctl usability improvement. It points to guidance for building GraphQL APIs with Fly and for running a private DNS over HTTPS (DoH) service, while noting Firefox’s default DoH rollout in the USA. It also announces a new Fly user community portal with GitHub or social-media sign-in, alongside Turboku’s Product Hunt launch for faster Heroku apps. The technical note covers flyctl 0.0.96’s -c/--completion option: supplying bash or zsh generates a completion file, with zsh users able to redirect it to $fpath\[1\]/\_flyctl and Bash users required to choose a location and source it from .bashrc.


### [GraphQL, Hasura and Fly](https://yomu.fyi/post/graphql-hasura-and-fly.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Feb 25, 2020
- Type: Tutorial

Hasura provides an open source GraphQL backend for accessing PostgreSQL, mapping database schemas and roles to simplify queries. It can also query other GraphQL services, allowing multiple services to be combined, and includes an interactive console for analysis and exploration. The post presents deploying Hasura on Fly using its Docker image to create a global GraphQL backend, with configuration required for the database location, secrets, and interactive-console availability. It points to a published deployment guide that walks through those steps and frames Fly as a simpler way to run Hasura, while directing readers to Fly Docs and a hands-on path for deploying a first app.


### [Successfully Merging the Work of 1000+ Developers](https://yomu.fyi/post/successfully-merging-the-work-of-1000-developers.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Nov 14, 2019
- Type: Problem & solution

Shopify’s single monolith supports changes 40 times a day and roughly 400 commits to master daily, making safe trunk-based development difficult at the scale of 1,000+ developers. Its first Merge Queue limited deployment drift and batch size, but queued pull requests did not receive CI, soft conflicts could break master, and a browser extension enabled accidental direct merges. Merge Queue v2 replaces that workflow with GitHub comments and webhooks, programmatic branch protection, an emergency /shipit --emergency path, and a predictive branch where queued changes receive CI before merging. A reconciliation algorithm synchronizes that branch through GitHub’s GraphQL API, while failure-tolerance thresholds handle flaky tests and remove repeatedly failing pull requests. CI starts when requests enter the queue; batches of eight and three concurrently tested batches balance throughput, risk, and resource use, while the changes improved user experience, deployment safety, and deploy throughput.


### [Want to Improve UI Performance? Start by Understanding Your User](https://yomu.fyi/post/want-to-improve-ui-performance-start-by-understanding-your-user.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Sep 20, 2019
- Type: Tutorial

Shopify’s team examined UI performance in the Marketing section of the Shopify admin, aiming to improve load time, perceived load time, and interactions after navigation. They tested the experience on a low-end Moto G3, profiled browser activity with Chrome Developer Tools and React DevTools, and used merchant workflows to reorder priorities. The work reduced unnecessary initial work by memoizing repeated date-formatting tasks, deferring the nonessential ImagePicker bundle, and prefetching that component and its data when a merchant hovered over its activator; memoization cut one component’s render time from about 64.7 ms to 0.5 ms. For loading states, the team recommends stable skeletons with static headings and immediately useful controls, such as the Create campaign button, so merchants can act before unrelated data arrives.


### [Building Resilient GraphQL APIs Using Idempotency](https://yomu.fyi/post/building-resilient-graphql-apis-using-idempotency.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Aug 27, 2019
- Type: Problem & solution

Shopify’s Payment Service uses API-level idempotency to make GraphQL payment mutations resilient to timeouts, connection failures, and ambiguous outcomes that could otherwise leave merchants unpaid or double-charge buyers. The design places a UUID-based idempotency key directly in each mutation input, identifies requests by client plus key, and locks concurrent duplicates so retries receive a 409 response while the original call is processing. An IncomingRequest record stores request state and completed recovery points, allowing completed responses to be replayed and incomplete attempts to recover before continuing. Handlers divide work into no-side-effect, transactional local-side-effect, and remote-side-effect steps, each optionally providing run and recover functions. The approach adds database-write overhead and requires careful compatibility testing when recovery points change, but the team reports that its structured handlers are clear and maintainable.


### [Unifying Our GraphQL Design Patterns and Best Practices with Tutorials](https://yomu.fyi/post/unifying-our-graphql-design-patterns-and-best-practices-with-tutorials.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Feb 13, 2019
- Type: Tutorial

Shopify describes how its GraphQL work grew from an early experiment for mobile APIs into contributions from hundreds of developers across teams and offices, including the Admin and Storefront APIs. As adoption expanded, sparse Markdown guidance left context inconsistently shared, while design guidelines were mixed with code-reference documentation and became difficult to extend for complex cases. The API Patterns Team, created in May 2017, addressed this by focusing on horizontal concerns, identifying common patterns, and documenting solutions for developers working across API domains. This work produced a living, in-depth design tutorial that explains Shopify’s GraphQL design philosophy through a practical example; its central rule is to understand the business domain and design the API to reflect it rather than the application’s implementation.


### [Solving the N+1 Problem for GraphQL through Batching](https://yomu.fyi/post/solving-the-n-1-problem-for-graphql-through-batching.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: Leanne Shapton
- Published: Apr 24, 2018
- Type: Problem & solution

GraphQL avoids REST’s over-fetching and under-fetching by letting clients request specific fields, but its field-specific resolvers can create the n+1 problem for nested data. With N authors, a server may make one datastore round trip for authors and N more for addresses, rather than loading all addresses in one additional trip. Shopify’s GraphQL Batch Ruby library addresses this through promises and batch loaders: resolvers request data without resolving immediately, similar loads are grouped, and the loaders fulfill them together. During execution, grouped promises are loaded and replaced with results, while nested fields can enter later batching rounds. The approach reduces datastore queries and computing power for the same requests, became general best practice at Shopify, and was released as open-source.


### [Event Sourcing made Simple](https://yomu.fyi/post/event-sourcing-made-simple.md)
- Company: [Kickstarter](https://yomu.fyi/company/kickstarter.md)
- Author: Philippe Creux
- Published: Apr 20, 2018
- Type: Explainer

Event Sourcing stores application changes as immutable events, providing a history that can explain how current data came to be. The post introduces four components: Events record changes, Calculators update Aggregates from those events, and Reactors trigger side effects or create further events. Kickstarter implemented a minimal framework for d.rip using regular Active Record aggregates, a regular SQL database, synchronous atomic updates, and roughly 200 lines of home-made code. The approach supports replaying history to reconstruct past state, repair calculator bugs, backfill new aggregate fields, optimize read models, and forward events to analytics platforms, while presenting naming and mutation-to-event decomposition as important challenges.


### [Functional Swift Conference 2017 — Brooklyn](https://yomu.fyi/post/functional-swift-conference-2017-brooklyn.md)
- Company: [Kickstarter](https://yomu.fyi/company/kickstarter.md)
- Author: Brandon Williams
- Published: Apr 28, 2017
- Type: Announcement

Kickstarter hosted the fourth Functional Swift Conference on April 15th, marking the third time the event had been held at its office. The all-day gathering brought together 10 speakers, including four Kickstarter engineers, and 90 attendees to discuss what functional programming can contribute to better Swift code. Sessions covered recursive enums and KD-trees, testing side-effects, domain-specific languages with GraphQL, algebraic laws, monoids, predicates, sorting functions, applicative functors, parsing, and type inference. Examples included using value types and recursive data structures to describe complicated objects and live-coding an applicative parsing API that generates its own documentation. The closing type-system talk examined why inference is hard and described the Swift compiler team’s use of graph theory to address inference problems practically.


[Newer posts](https://yomu.fyi/topic/graphql/page/2.md)