# Setting Up Authentication and Authorization with Apollo Federation

DevFeed: [Setting Up Authentication and Authorization with Apollo Federation](<https://devfeed.tech/articles/setting-up-authentication-and-authorization-with-apollo-federation-23517.md>)

Original publisher: [Read original article](<https://www.apollographql.com/blog/setting-up-authentication-and-authorization-apollo-federation>)

Author: Mandi Wise

Published: 2020-05-15T12:17:09Z

Content type: tutorial

Language: en

Sources: [Apollo Blog](<https://devfeed.tech/sources/apollo-blog.md>)

Topics: [GraphQL](<https://devfeed.tech/topics/graphql.md>), [apollo-server](<https://devfeed.tech/topics/apollo-server.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Express](<https://devfeed.tech/topics/express.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [API](<https://devfeed.tech/topics/api.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [apollo](<https://devfeed.tech/tags/apollo.md>), [apollo-federation](<https://devfeed.tech/tags/apollo-federation.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [backend](<https://devfeed.tech/tags/backend.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [middleware](<https://devfeed.tech/tags/middleware.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

## AI overview

This tutorial explains how to add authentication and authorization to a distributed GraphQL architecture using Apollo Federation. It covers signing and verifying JWTs at the gateway, forwarding tokens to an implementing service, and checking user permissions before resolver functions run.

## Source excerpt

Update: Auth now available in Apollo Router Apollo has shipped our new authentication and authorization features as built-in Router features. Checkout the launch post: When building out a distributed GraphQL architecture with Apollo Federation, we will often need to limit query access based on who requested the data (authentication) and whether they're allowed to see or change the data they requested (authorization).