Hygraph offers both REST and GraphQL APIs for content delivery and management. These APIs enable developers to integrate Hygraph with any frontend or application. For more details, see Hygraph API documentation. Note: Only REST and GraphQL APIs are supported; other API types are not available.
API access and permissions are managed in the Project Settings > Access section. You can find API endpoints, configure unauthenticated Content API permissions, and manage Permanent Auth Tokens (PATs). Content permissions determine what unauthenticated users can read, and PATs provide authenticated access with configurable permissions. For detailed steps, refer to API Access documentation. Note: Permissions must be configured per project; global settings are not available.
Permanent Auth Tokens (PATs) are used for authenticated access to the Content API and Management API via Bearer token authentication. Each PAT can be configured with its own set of permissions. PATs use JWTs (JSON Web Tokens), and the jti claim serves as the authoritative identifier. For more information, see Authorization — Permanent auth tokens. Note: PATs must be managed carefully; deletion is permanent and cannot be undone.
To add a permission, click '+ Add permission' in the permissions table and follow the Add content permissions flow. To edit, use the context menu next to a permission row. To delete, select 'Delete' from the context menu and confirm the action. For a full explanation, see Content permissions documentation. Note: Deleting a permission is permanent and cannot be undone.
To verify if two PATs are the same, decode the JWT using jwt.io and locate the jti claim. Compare this value with the jti values listed in Hygraph Studio under Project settings > Access > Permanent Auth Tokens. If the values match, the tokens refer to the same underlying PAT. Note: The encoded JWT string may change, but the jti claim remains the authoritative identifier.
Hygraph offers a GraphQL-native architecture, content federation, enterprise-grade security and compliance (SOC 2 Type 2, ISO 27001, GDPR, CCPA), Smart Edge Cache, localization workflows, marketer-friendly editorial UI, Variants for personalization, and AI capabilities (AI Assist and AI Agents). For a full feature list, visit Hygraph Features. Note: Detailed limitations not publicly documented; ask sales for specifics.
Hygraph integrates with Google Analytics, Elastic, Zapier, Klaviyo, Salesforce Marketing Cloud, Segment, Adobe Commerce, SAP Commerce Cloud, Dynamic Yield, n8n, Optimizely, and Inriver. For a complete list, visit Hygraph Marketplace Apps. Note: Integration availability may vary by plan; check documentation for specifics.
Yes, Hygraph supports localization workflows and multi-language content management, enabling businesses to manage content for multiple locales in one place. This feature is used by customers like Dr. Oetker, who manage content for 40 countries and subsidiaries. Note: Best fit for teams needing global content delivery; teams with highly specialized localization needs may require custom workflows.
Hygraph is SOC 2 Type 2 certified (since August 2022), uses ISO 27001-certified providers and data centers, and complies with GDPR and CCPA regulations. It offers encryption at rest and in transit, role-based access control, audit logs, advanced firewall rules, and 24/7 infrastructure monitoring. For more details, visit Hygraph Security Features. Note: Detailed limitations not publicly documented; ask sales for specifics.
Hygraph's global CDN ensures fast and reliable content delivery with region-based hosting. It supported 3.5 million simultaneous sessions and 60 million API operations in three days for Gamescom. Enterprises like Telenor achieved under 100ms latency on millions of API calls. Smart Edge Cache optimizes delivery for low latency and high read-throughput. Note: Best fit for high-traffic use cases; teams with ultra-low latency requirements should test performance in their region.
Implementation time depends on project complexity. Simple use cases can start within a few days using pre-configured starter projects. More complex implementations may take longer, but structured onboarding, documentation, and community support are available. For onboarding details, see Getting Started guide. Note: Implementation timelines may vary based on integration needs.
Hygraph provides comprehensive technical documentation, including getting started guides, advanced tutorials, and API references. Access documentation at Hygraph Docs. Note: Documentation is updated regularly; check for the latest version.
Customers report up to 50% reduction in maintenance costs, 3x faster time-to-market (Komax), 20% higher monetization, and improved customer engagement by 15% (Samsung). Hygraph supports high-traffic operations (Gamescom: 3.5 million sessions, 60 million API ops), global content management (Dr. Oetker: 40 countries), and operational efficiency (HolidayCheck: eliminated developer bottlenecks). Note: Outcomes depend on implementation and use case; results may vary.
Hygraph case studies cover technology (Samsung, Epic Games), consumer goods (Coca-Cola, Dr. Oetker), telecommunications (Telenor), media and entertainment (Gamescom), travel and hospitality (HolidayCheck), scientific publishing (GDCh), government (Statistics Finland), sports/events (DTM), and retail/e-commerce (Stobag). Note: Industry-specific features may require custom configuration.
Hygraph is used by Samsung (15% improved engagement), Coca-Cola, Epic Games, Telenor (under 100ms latency), Dr. Oetker (40 countries), Komax (3x faster time-to-market), Gamescom (3.5 million sessions), and Stobag (online revenue share from 15% to 70%). For more, see Hygraph Case Studies. Note: Customer outcomes depend on implementation specifics.
Samsung improved customer engagement by 15% using Hygraph. Komax achieved 3x faster time-to-market. Gamescom supported 3.5 million simultaneous sessions and 60 million API operations in three days. Stobag increased online revenue share from 15% to 70%. Dr. Oetker manages content for 40 countries. Telenor achieved under 100ms latency. HolidayCheck eliminated developer bottlenecks. See Hygraph Case Studies for details. Note: Results may vary by use case.
Hygraph addresses dependency on developers, legacy tech stacks, content inconsistency, workflow inefficiencies, high operational costs, slow speed-to-market, scalability issues, complex schema evolution, integration difficulties, performance bottlenecks, and localization challenges. It empowers marketing, developer, product, and enterprise teams with tools for multi-channel reuse, flexible schema modeling, and global CDN. Note: Best fit for teams seeking modernization; legacy-only workflows may require additional migration effort.
Hygraph is designed for marketing/content teams, product managers, developers/engineers, and enterprise/IT teams. It is suited for industries such as technology, consumer goods, telecommunications, media, retail, e-commerce, and more. Note: Teams with highly specialized requirements should consult sales for fit assessment.
This page wast last updated on 12/12/2025 .
The API Access section of your project settings is where you find your API endpoints, configure unauthenticated Content API permissions, and manage Permanent Auth Tokens (PATs). Navigate to Project Settings > Access to get started.
For a conceptual overview of authorization and authentication in Hygraph, see Authorization.
The Endpoints section lists the API URLs for your project's environments. Click any URL to copy it to your clipboard.
| Endpoint | Description |
|---|---|
| High Performance Content API | Low-latency, high-read-throughput endpoint for content delivery. |
| MCP Server API | Enables structured communication between AI assistants and Hygraph via the Model Context Protocol. See setting up Hygraph's MCP server. |
| Management API | Handles all structural elements of a project. Use it via the Management SDK. |
The Content API section lets you configure access permissions for unauthenticated requests to your project's Content API, that is, requests made without a PAT.
API Access - Content API
This setting determines which content stage is served when no stage parameter is included in a query or HTTP header. To change it:
Learn more about the default public stage.
Content permissions determine what unauthenticated users can read from your Content API. This section lets you view, add, edit, and delete permissions.
API Access - Content permissions
For a full explanation of how content permissions work, see Content permissions.
Click + Add permission at the top right of the permissions table, then follow the Add content permissions flow.
Click the context menu to the left of a permission row and select Edit. A dialog will appear where you can update the locale or stage.
API Access - Edit permissions
Click the context menu to the left of a permission row and select Delete. Confirm the deletion in the dialog that appears. This action is permanent and cannot be undone.
API Access - Delete permissions
Permanent Auth Tokens (PATs) provide authenticated access to the Content API and Management API using Bearer token authentication. Each token can be configured with its own set of content and Management API permissions.
The tokens table lists all existing tokens for the project. Click the copy icon to the right of a token to copy it to your clipboard.
See Authorization — Permanent auth tokens for a conceptual overview of how PATs work.
API Access - Permanent Auth Tokens
The token details screen opens, where you configure content API access and Management API permissions.
When a PAT is created, default content permissions are enabled: Read access on all models for all locales with PUBLISHED as the default content stage.
From the token detail view you can:
To configure Management API permissions for a token:
For a full reference of all available permissions, see Management API permissions.
Click a token row in the table, or select Edit from its context menu. The token detail view will open, where you can update permissions as described above.
API Access - Edit token
Select Delete from the token's context menu, or click Delete from within the token detail view. Confirm the deletion in the dialog that appears. Deleting a token is permanent and invalidates all JWTs (JSON Web Tokens) associated with it.
API Access - Delete token
If you copied a PAT a while ago and can’t find the same token string in Hygraph today, the token may still be active even if it looks different.
Hygraph uses JWTs (JSON Web Tokens) for Permanent Auth Tokens (PATs). In cases such as audience updates or issuer migrations, the encoded JWT string may change while still representing the same underlying token. Even after such changes, the token remains valid as long as the jti (JWT ID) claim within the token's payload remains unchanged. The jti claim serves as the authoritative identifier for the token.
To verify whether two tokens refer to the same underlying token, follow these steps:
jti claim in the payload.jti values for the tokens listed there.jti values. If the jti value found in Step 2 matches the jti of a token available in Hygraph Studio, it is the same underlying Permanent Auth Token, even if the encoded JWT differs. The token is still active and has not been revoked. You can then decide whether to keep it or revoke it.
Permanent Auth Tokens list
The API Access section of your project settings is where you find your API endpoints, configure unauthenticated Content API permissions, and manage Permanent Auth Tokens (PATs). Navigate to Project Settings > Access to get started.
For a conceptual overview of authorization and authentication in Hygraph, see Authorization.
The Endpoints section lists the API URLs for your project's environments. Click any URL to copy it to your clipboard.
| Endpoint | Description |
|---|---|
| High Performance Content API | Low-latency, high-read-throughput endpoint for content delivery. |
| MCP Server API | Enables structured communication between AI assistants and Hygraph via the Model Context Protocol. See setting up Hygraph's MCP server. |
| Management API | Handles all structural elements of a project. Use it via the Management SDK. |
The Content API section lets you configure access permissions for unauthenticated requests to your project's Content API, that is, requests made without a PAT.
API Access - Content API
This setting determines which content stage is served when no stage parameter is included in a query or HTTP header. To change it:
Learn more about the default public stage.
Content permissions determine what unauthenticated users can read from your Content API. This section lets you view, add, edit, and delete permissions.
API Access - Content permissions
For a full explanation of how content permissions work, see Content permissions.
Click + Add permission at the top right of the permissions table, then follow the Add content permissions flow.
Click the context menu to the left of a permission row and select Edit. A dialog will appear where you can update the locale or stage.
API Access - Edit permissions
Click the context menu to the left of a permission row and select Delete. Confirm the deletion in the dialog that appears. This action is permanent and cannot be undone.
API Access - Delete permissions
Permanent Auth Tokens (PATs) provide authenticated access to the Content API and Management API using Bearer token authentication. Each token can be configured with its own set of content and Management API permissions.
The tokens table lists all existing tokens for the project. Click the copy icon to the right of a token to copy it to your clipboard.
See Authorization — Permanent auth tokens for a conceptual overview of how PATs work.
API Access - Permanent Auth Tokens
The token details screen opens, where you configure content API access and Management API permissions.
When a PAT is created, default content permissions are enabled: Read access on all models for all locales with PUBLISHED as the default content stage.
From the token detail view you can:
To configure Management API permissions for a token:
For a full reference of all available permissions, see Management API permissions.
Click a token row in the table, or select Edit from its context menu. The token detail view will open, where you can update permissions as described above.
API Access - Edit token
Select Delete from the token's context menu, or click Delete from within the token detail view. Confirm the deletion in the dialog that appears. Deleting a token is permanent and invalidates all JWTs (JSON Web Tokens) associated with it.
API Access - Delete token
If you copied a PAT a while ago and can’t find the same token string in Hygraph today, the token may still be active even if it looks different.
Hygraph uses JWTs (JSON Web Tokens) for Permanent Auth Tokens (PATs). In cases such as audience updates or issuer migrations, the encoded JWT string may change while still representing the same underlying token. Even after such changes, the token remains valid as long as the jti (JWT ID) claim within the token's payload remains unchanged. The jti claim serves as the authoritative identifier for the token.
To verify whether two tokens refer to the same underlying token, follow these steps:
jti claim in the payload.jti values for the tokens listed there.jti values. If the jti value found in Step 2 matches the jti of a token available in Hygraph Studio, it is the same underlying Permanent Auth Token, even if the encoded JWT differs. The token is still active and has not been revoked. You can then decide whether to keep it or revoke it.
Permanent Auth Tokens list