GraphQL Mesh can gain new capabilities by using plugins.

  - some-plugin: # name of the plugin
      # ...pluginConfig can be found inside the dedicated documentation
PluginNPM PackageDocs
Live Queries@graphql-mesh/plugin-live-querydocs
Response Caching@graphql-mesh/plugin-response-cachedocs
Operation Field Permissions@graphql-mesh/plugin-operation-field-permissionsdocs
Rate Limit@graphql-mesh/plugin-rate-limitdocs

Additional Plugins

Envelop is a library that helps build GraphQL API faster and flexibly with plugin-based architecture.

Similar to Express middlewares allowing you to customize requests' behavior, Envelop applies the same idea to GraphQL requests.

By exposing hooks in all the phases of a GraphQL Request execution, Envelop enables the creation of plugins that simplify the setup of standard API features such as:

  • Security: Depth limits, Rate limiting
  • Authentication
  • Advanced caching
  • Error handling: Sentry, error masking
  • Monitoring: Hive
  • Logging
  • Tracing: NewRelic, Datadog, StatsD, Apollo Tracing

An Envelop plugin is a standalone npm package that provides a plugin function that can be used in an Envelop setup to customize a GraphQL API behavior.

Examples of plugins are:

  • useGenericAuth (@envelop/generic-auth): Custom authentication flow by providing a custom user resolver.
  • useDepthLimit (@envelop/depth-limit): Limit the depth of executed selection sets.

The GraphQL Mesh configuration accepts an additionalEnvelopPlugins parameter that should point to a file that exports a list of Envelop plugins, as shown below:

  # …
additionalEnvelopPlugins: './envelopPlugins'
import { PluginOrDisabledPlugin } from '@envelop/core'
import { useDepthLimit } from '@envelop/depth-limit'
import { useSentry } from '@envelop/sentry'
const plugins: PluginOrDisabledPlugin = [
    maxDepth: 10
    includeRawResult: false
export default plugins
Note: The file can also export a factory function returning a PluginOrDisabledPlugin list

Plugins Hooks

Mesh provides each plugin with unique hooks:

  • onFetch: triggered when fetch is called. Enables parameters manipulation, logging and even fetch function replacement.
  • onDelegate: triggered when a request is forwarded to the upstream (Either by context SDK or directly through the gateway).

Those hooks has access to all remote execution parameters (root, args, context, info etc).

Last updated on September 21, 2022