Standard practice for a GraphQL APi is to use token-based authentication, commonly using JWT (JSON web tokens: https://jwt.io/). This would be implemented as part of the 'business logic', replacing, or complimenting, the key-based authentication which, by contrast, adds a field to the schema. The library PyJWT provides the needed support to easily add token-based authentication; it can be extended to token-based authorization should roles be defined in the future. There are several simple design questions to be discussed, and conclusions will be summarized here.