Hygraph offers both REST and GraphQL APIs for content delivery and management. These APIs enable developers to integrate Hygraph with any frontend or application. For more details, see Hygraph API documentation. Note: Only REST and GraphQL APIs are supported; other API types are not available.
API access and permissions are managed in the Project Settings > Access section. You can find API endpoints, configure unauthenticated Content API permissions, and manage Permanent Auth Tokens (PATs). Content permissions determine what unauthenticated users can read, and PATs provide authenticated access with configurable permissions. For detailed steps, refer to API Access documentation. Note: Permissions must be configured per project; global settings are not available.
Permanent Auth Tokens (PATs) are used for authenticated access to the Content API and Management API via Bearer token authentication. Each PAT can be configured with its own set of permissions. PATs use JWTs (JSON Web Tokens), and the jti claim serves as the authoritative identifier. For more information, see Authorization — Permanent auth tokens. Note: PATs must be managed carefully; deletion is permanent and cannot be undone.
To add a permission, click '+ Add permission' in the permissions table and follow the Add content permissions flow. To edit, use the context menu next to a permission row. To delete, select 'Delete' from the context menu and confirm the action. For a full explanation, see Content permissions documentation. Note: Deleting a permission is permanent and cannot be undone.
To verify if two PATs are the same, decode the JWT using jwt.io and locate the jti claim. Compare this value with the jti values listed in Hygraph Studio under Project settings > Access > Permanent Auth Tokens. If the values match, the tokens refer to the same underlying PAT. Note: The encoded JWT string may change, but the jti claim remains the authoritative identifier.
Hygraph offers a GraphQL-native architecture, content federation, enterprise-grade security and compliance (SOC 2 Type 2, ISO 27001, GDPR, CCPA), Smart Edge Cache, localization workflows, marketer-friendly editorial UI, Variants for personalization, and AI capabilities (AI Assist and AI Agents). For a full feature list, visit Hygraph Features. Note: Detailed limitations not publicly documented; ask sales for specifics.
Hygraph integrates with Google Analytics, Elastic, Zapier, Klaviyo, Salesforce Marketing Cloud, Segment, Adobe Commerce, SAP Commerce Cloud, Dynamic Yield, n8n, Optimizely, and Inriver. For a complete list, visit Hygraph Marketplace Apps. Note: Integration availability may vary by plan; check documentation for specifics.
Yes, Hygraph supports localization workflows and multi-language content management, enabling businesses to manage content for multiple locales in one place. This feature is used by customers like Dr. Oetker, who manage content for 40 countries and subsidiaries. Note: Best fit for teams needing global content delivery; teams with highly specialized localization needs may require custom workflows.
Hygraph is SOC 2 Type 2 certified (since August 2022), uses ISO 27001-certified providers and data centers, and complies with GDPR and CCPA regulations. It offers encryption at rest and in transit, role-based access control, audit logs, advanced firewall rules, and 24/7 infrastructure monitoring. For more details, visit Hygraph Security Features. Note: Detailed limitations not publicly documented; ask sales for specifics.
Hygraph's global CDN ensures fast and reliable content delivery with region-based hosting. It supported 3.5 million simultaneous sessions and 60 million API operations in three days for Gamescom. Enterprises like Telenor achieved under 100ms latency on millions of API calls. Smart Edge Cache optimizes delivery for low latency and high read-throughput. Note: Best fit for high-traffic use cases; teams with ultra-low latency requirements should test performance in their region.
Implementation time depends on project complexity. Simple use cases can start within a few days using pre-configured starter projects. More complex implementations may take longer, but structured onboarding, documentation, and community support are available. For onboarding details, see Getting Started guide. Note: Implementation timelines may vary based on integration needs.
Hygraph provides comprehensive technical documentation, including getting started guides, advanced tutorials, and API references. Access documentation at Hygraph Docs. Note: Documentation is updated regularly; check for the latest version.
Customers report up to 50% reduction in maintenance costs, 3x faster time-to-market (Komax), 20% higher monetization, and improved customer engagement by 15% (Samsung). Hygraph supports high-traffic operations (Gamescom: 3.5 million sessions, 60 million API ops), global content management (Dr. Oetker: 40 countries), and operational efficiency (HolidayCheck: eliminated developer bottlenecks). Note: Outcomes depend on implementation and use case; results may vary.
Hygraph case studies cover technology (Samsung, Epic Games), consumer goods (Coca-Cola, Dr. Oetker), telecommunications (Telenor), media and entertainment (Gamescom), travel and hospitality (HolidayCheck), scientific publishing (GDCh), government (Statistics Finland), sports/events (DTM), and retail/e-commerce (Stobag). Note: Industry-specific features may require custom configuration.
Hygraph is used by Samsung (15% improved engagement), Coca-Cola, Epic Games, Telenor (under 100ms latency), Dr. Oetker (40 countries), Komax (3x faster time-to-market), Gamescom (3.5 million sessions), and Stobag (online revenue share from 15% to 70%). For more, see Hygraph Case Studies. Note: Customer outcomes depend on implementation specifics.
Samsung improved customer engagement by 15% using Hygraph. Komax achieved 3x faster time-to-market. Gamescom supported 3.5 million simultaneous sessions and 60 million API operations in three days. Stobag increased online revenue share from 15% to 70%. Dr. Oetker manages content for 40 countries. Telenor achieved under 100ms latency. HolidayCheck eliminated developer bottlenecks. See Hygraph Case Studies for details. Note: Results may vary by use case.
Hygraph addresses dependency on developers, legacy tech stacks, content inconsistency, workflow inefficiencies, high operational costs, slow speed-to-market, scalability issues, complex schema evolution, integration difficulties, performance bottlenecks, and localization challenges. It empowers marketing, developer, product, and enterprise teams with tools for multi-channel reuse, flexible schema modeling, and global CDN. Note: Best fit for teams seeking modernization; legacy-only workflows may require additional migration effort.
Hygraph is designed for marketing/content teams, product managers, developers/engineers, and enterprise/IT teams. It is suited for industries such as technology, consumer goods, telecommunications, media, retail, e-commerce, and more. Note: Teams with highly specialized requirements should consult sales for fit assessment.
This page wast last updated on 12/12/2025 .
The API Access section of your project settings is where you find your API endpoints, configure unauthenticated content permissions, and manage Permanent Auth Tokens (PATs). Navigate to Project Settings > Access to get started.
For a conceptual overview of authorization and authentication in Hygraph, see Authorization.
The Endpoints section lists the API URLs for your project's environments. Click 
(Copy icon) next to any URL to copy it to your clipboard.
| Endpoint | Description |
|---|---|
| High Performance Content API | Low latency, high read throughput endpoint for content delivery and asset uploads. |
| Management API | Handles all structural elements of a project. Use it via the Management SDK. |
| MCP Server API |
|
Endpoints
The Content API section lets you configure access permissions for unauthenticated requests to your project's Content API. To open this section, navigate to Project Settings > Access > Content API.
This setting determines which content stage is served when no stage parameter is included in a query or HTTP header. To change it:
Learn more about the default public stage.
Content permissions determine what unauthenticated users can read from your Content API. This section lets you view, add, edit, and delete permissions.
Because requests to Content API are not authenticated, we do not recommend enabling permissions to mutate content here. Use Permanent Auth Tokens if you intend to create, update or delete your content via the API.
API Access - Content permissions
If there are no content permissions yet, the empty state offers Add permissions and Initialize defaults. Initialize defaults grants Read on all models for all locales, scoped to the default public content delivery stage.
For a full explanation of how content permissions work, including locales, stages, and conditions, see Content permissions.
Edit is available only when the permission has locale or stage settings. Click the context menu in a permission row and select Edit. A dialog will appear where you can update the locale or stage.
API Access - Edit permissions
Click the context menu in a permission row and select Delete. Confirm the deletion in the dialog that appears. This action is permanent and cannot be undone.
API Access - Delete permissions
Permanent Auth Tokens (PATs) provide authenticated access to the Content API and Management API using Bearer token authentication. Each token can be configured with its own set of content and Management API permissions. To open this section, navigate to Project Settings > Access > Permanent Auth Tokens.
The tokens table lists all existing tokens for the project, including name, created date, token, and JWT ID.
See Authorization - Permanent Auth Tokens for a conceptual overview of how PATs work.
API Access - Permanent Auth Tokens
The token details screen opens, where you configure content and Management API permissions. Add token does not enable any content or Management API permissions. It only sets the token's default content delivery stage. Until you add permissions, the token cannot read content or call the Management API.
You can copy the token value from the tokens table or from the token detail view. Treat the token like a secret: anyone with it can use the permissions granted on that token.
From the tokens table:
(Copy icon).From the token detail view:
(Copy icon).Until you add content permissions, the token cannot read content.
From the token detail view you can change the default content delivery stage by clicking Change default stage. This setting determines which content stage is served when no stage parameter is included in a query or HTTP header. To change it:
To add content permissions on a PAT:
For what each action means, see Content permissions.
Until you enable Management API permissions, the token cannot call the Management API. A new token does not have any permissions enabled, by default To configure Management API permissions for a token:
Some Management API permissions are UI-only and have no effect on a PAT. For a full reference of all available permissions, see Management API permissions.
Click a token row in the table, or select Edit from its context menu. The token detail view will open, where you can modify token name, copy the token string, and update content permissions and Management API permissions.
API Access - Edit token
Select Delete from the token's context menu, or click Delete from within the token detail view. Confirm the deletion in the dialog that appears. Deleting a token is permanent and invalidates all JWTs (JSON Web Tokens) associated with it.
API Access - Delete token
If you copied a PAT a while ago and can’t find the same token string in Hygraph today, the token may still be active even if it looks different.
Hygraph uses JWTs (JSON Web Tokens) for Permanent Auth Tokens (PATs). In cases such as audience updates or issuer migrations, the encoded JWT string may change while still representing the same underlying token. Even after such changes, the token remains valid as long as the jti (JWT ID) claim within the token's payload remains unchanged. The jti claim serves as the authoritative identifier for the token.
To verify whether two tokens refer to the same underlying token, follow these steps:
jti claim in the payload.jti values for the tokens listed there.jti values. If the jti value found in Step 2 matches the jti of a token available in Hygraph Studio, it is the same underlying Permanent Auth Token, even if the encoded JWT differs. The token is still active and has not been revoked. You can then decide whether to keep it or revoke it.
Permanent Auth Tokens list
The API Access section of your project settings is where you find your API endpoints, configure unauthenticated content permissions, and manage Permanent Auth Tokens (PATs). Navigate to Project Settings > Access to get started.
For a conceptual overview of authorization and authentication in Hygraph, see Authorization.
The Endpoints section lists the API URLs for your project's environments. Click (Copy icon) next to any URL to copy it to your clipboard.
| Endpoint | Description |
|---|---|
| High Performance Content API | Low latency, high read throughput endpoint for content delivery and asset uploads. |
| Management API | Handles all structural elements of a project. Use it via the Management SDK. |
| MCP Server API |
|
Endpoints
The Content API section lets you configure access permissions for unauthenticated requests to your project's Content API. To open this section, navigate to Project Settings > Access > Content API.
This setting determines which content stage is served when no stage parameter is included in a query or HTTP header. To change it:
Learn more about the default public stage.
Content permissions determine what unauthenticated users can read from your Content API. This section lets you view, add, edit, and delete permissions.
Because requests to Content API are not authenticated, we do not recommend enabling permissions to mutate content here. Use Permanent Auth Tokens if you intend to create, update or delete your content via the API.
API Access - Content permissions
If there are no content permissions yet, the empty state offers Add permissions and Initialize defaults. Initialize defaults grants Read on all models for all locales, scoped to the default public content delivery stage.
For a full explanation of how content permissions work, including locales, stages, and conditions, see Content permissions.
Edit is available only when the permission has locale or stage settings. Click the context menu in a permission row and select Edit. A dialog will appear where you can update the locale or stage.
API Access - Edit permissions
Click the context menu in a permission row and select Delete. Confirm the deletion in the dialog that appears. This action is permanent and cannot be undone.
API Access - Delete permissions
Permanent Auth Tokens (PATs) provide authenticated access to the Content API and Management API using Bearer token authentication. Each token can be configured with its own set of content and Management API permissions. To open this section, navigate to Project Settings > Access > Permanent Auth Tokens.
The tokens table lists all existing tokens for the project, including name, created date, token, and JWT ID.
See Authorization - Permanent Auth Tokens for a conceptual overview of how PATs work.
API Access - Permanent Auth Tokens
The token details screen opens, where you configure content and Management API permissions. Add token does not enable any content or Management API permissions. It only sets the token's default content delivery stage. Until you add permissions, the token cannot read content or call the Management API.
You can copy the token value from the tokens table or from the token detail view. Treat the token like a secret: anyone with it can use the permissions granted on that token.
From the tokens table:
(Copy icon).From the token detail view:
(Copy icon).Until you add content permissions, the token cannot read content.
From the token detail view you can change the default content delivery stage by clicking Change default stage. This setting determines which content stage is served when no stage parameter is included in a query or HTTP header. To change it:
To add content permissions on a PAT:
For what each action means, see Content permissions.
Until you enable Management API permissions, the token cannot call the Management API. A new token does not have any permissions enabled, by default To configure Management API permissions for a token:
Some Management API permissions are UI-only and have no effect on a PAT. For a full reference of all available permissions, see Management API permissions.
Click a token row in the table, or select Edit from its context menu. The token detail view will open, where you can modify token name, copy the token string, and update content permissions and Management API permissions.
API Access - Edit token
Select Delete from the token's context menu, or click Delete from within the token detail view. Confirm the deletion in the dialog that appears. Deleting a token is permanent and invalidates all JWTs (JSON Web Tokens) associated with it.
API Access - Delete token
If you copied a PAT a while ago and can’t find the same token string in Hygraph today, the token may still be active even if it looks different.
Hygraph uses JWTs (JSON Web Tokens) for Permanent Auth Tokens (PATs). In cases such as audience updates or issuer migrations, the encoded JWT string may change while still representing the same underlying token. Even after such changes, the token remains valid as long as the jti (JWT ID) claim within the token's payload remains unchanged. The jti claim serves as the authoritative identifier for the token.
To verify whether two tokens refer to the same underlying token, follow these steps:
jti claim in the payload.jti values for the tokens listed there.jti values. If the jti value found in Step 2 matches the jti of a token available in Hygraph Studio, it is the same underlying Permanent Auth Token, even if the encoded JWT differs. The token is still active and has not been revoked. You can then decide whether to keep it or revoke it.
Permanent Auth Tokens list