Building GraphQL APIs rapidly without writing backend code
Need instant CRUD APIs from existing PostgreSQL databases
Implementing granular row-level and column-level security
Building real-time applications with GraphQL subscriptions
Integrating multiple data sources (databases, REST APIs, GraphQL services)
Creating event-driven architectures with database triggers
Extending GraphQL with custom business logic via Actions
Implementing authentication and authorization at the API layer
Building admin panels, dashboards, or internal tools quickly
Migrating from REST to GraphQL without rewriting backend
Needing production-ready features (caching, rate limiting, monitoring)
Building multi-tenant SaaS applications with role-based access

Core Concepts

Instant GraphQL API Generation

Hasura's primary value proposition is automatic GraphQL API generation from your database schema:

Table Tracking: Point Hasura at PostgreSQL tables to instantly get queries, mutations, and subscriptions
Relationship Detection: Automatically infers foreign key relationships as GraphQL connections
Type Safety: Database schema translates directly to GraphQL types
Zero Code: No resolver writing, no ORM configuration, no boilerplate
Real-time by Default: Every query automatically has a subscription counterpart

How it works:

Connect Hasura to your PostgreSQL database
Track tables in the Hasura Console
GraphQL API is immediately available with:
- query - Fetch data with filtering, sorting, pagination
- mutation - Insert, update, delete operations
- subscription - Real-time data updates via WebSockets

Metadata-Driven Architecture

Hasura is metadata-driven, not code-driven:

Metadata: JSON/YAML configuration defining your API
Declarative: Define what you want, not how to implement it
Version Control: Metadata files can be committed to Git
CLI Migration: Hasura CLI manages metadata and migrations
Programmatic Control: Metadata API for automation

Key metadata components:

Table tracking and relationships
Permission rules
Remote schemas
Actions
Event triggers
Custom functions

Permission System

Hasura's permission system is its most powerful feature, enabling fine-grained access control:

Role-Based: Define permissions per GraphQL operation per role
Row-Level Security: Control which rows users can access
Column-Level Security: Hide sensitive columns from specific roles
Session Variables: Dynamic permissions based on JWT claims or webhook data
Check Constraints: Boolean expressions determining access

Permission Types:

select - Read permissions
insert - Create permissions
update - Modify permissions
delete - Remove permissions

Authentication Integration

Hasura delegates authentication to your auth service but handles authorization:

JWT Mode: Validate JWT tokens containing user claims
Webhook Mode: Call webhook to get session variables
Session Variables: x-hasura-role, x-hasura-user-id, custom claims
Multi-Provider: Support Auth0, Firebase, Cognito, custom auth

Auth Flow:

User authenticates with your auth service (Auth0, Firebase, custom)
Auth service issues JWT with Hasura claims
Client sends JWT in Authorization header
Hasura validates JWT and extracts session variables
Permissions evaluated using session variables
GraphQL query executed with appropriate access control

Event Triggers

Event Triggers enable event-driven architectures by invoking webhooks on database changes:

Database Events: INSERT, UPDATE, DELETE triggers
Reliable Delivery: At-least-once delivery with retries
Payload: Old and new row data in JSON
Async Processing: Long-running tasks, external integrations
Use Cases: Send emails, sync to Elasticsearch, update cache, trigger workflows

Actions

Actions extend Hasura with custom business logic:

Custom Mutations: Define GraphQL mutations handled by your code
Custom Queries: Add custom query logic beyond database access
REST Integration: Call REST APIs from GraphQL
Type Safety: Define input/output types in GraphQL SDL
Handler: Your HTTP endpoint receives GraphQL variables

Common use cases:

Payment processing
Complex validations
Third-party API calls
Custom algorithms
File uploads
Email sending

Remote Schemas

Remote Schemas enable schema stitching by merging external GraphQL APIs:

Schema Stitching: Unify multiple GraphQL services
Type Extension: Extend types with fields from remote schemas
Permissions: Apply role-based permissions to remote schemas
Namespace: Isolate remote schemas to avoid conflicts
Use Cases: Microservices, legacy GraphQL APIs, third-party services

Real-Time Subscriptions

Hasura provides native GraphQL subscriptions:

Live Queries: Automatically push updates when data changes
WebSocket Protocol: Efficient bi-directional communication
Multiplexing: Optimize subscriptions for many concurrent clients
Filtering: Subscribe to specific subsets of data
Polling Fallback: HTTP-based streaming for restricted networks

Permission System Deep Dive

Row-Level Security

Row-level security uses boolean check expressions to filter accessible rows:

Example: Users can only see their own data

{
  "check": {
    "user_id": {
      "_eq": "X-Hasura-User-Id"
    }
  }
}

Example: Multi-tenant data isolation

{
  "check": {
    "tenant_id": {
      "_eq": "X-Hasura-Tenant-Id"
    }
  }
}

Example: Complex access rules

{
  "check": {
    "_or": [
      {
        "user_id": {
          "_eq": "X-Hasura-User-Id"
        }
      },
      {
        "is_public": {
          "_eq": true
        }
      }
    ]
  }
}

Column-Level Security

Control which columns are visible per role:

Example: Hide sensitive user fields

select:
  columns:
    - id
    - username
    - email
    # password_hash is hidden
    # created_at is hidden

Example: Different views for different roles

# Admin role sees all columns
select:
  columns: "*"

# User role sees limited columns
select:
  columns:
    - id
    - username
    - profile_picture

Insert Permissions

Control what data can be inserted:

Example: Set user_id from session

{
  "check": {
    "user_id": {
      "_eq": "X-Hasura-User-Id"
    }
  },
  "set": {
    "user_id": "X-Hasura-User-Id"
  }
}

Example: Validate ownership before insert

{
  "check": {
    "project": {
      "owner_id": {
        "_eq": "X-Hasura-User-Id"
      }
    }
  }
}

Update Permissions

Control which rows can be updated and what values can be set:

Example: Update own data only

{
  "filter": {
    "user_id": {
      "_eq": "X-Hasura-User-Id"
    }
  },
  "check": {
    "user_id": {
      "_eq": "X-Hasura-User-Id"
    }
  },
  "set": {
    "updated_at": "now()"
  }
}

filter: Which rows can be selected for update check: Validation after update completes set: Automatically set column values

Delete Permissions

Control which rows can be deleted:

Example: Delete own data only

{
  "filter": {
    "user_id": {
      "_eq": "X-Hasura-User-Id"
    }
  }
}

Authentication Integration

JWT Mode Configuration

Configure Hasura to validate JWT tokens:

Environment Variable:

HASURA_GRAPHQL_JWT_SECRET='{
  "type": "RS256",
  "key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
}'

JWT Claims Structure:

{
  "sub": "user123",
  "iat": 1633024800,
  "exp": 1633111200,
  "https://hasura.io/jwt/claims": {
    "x-hasura-default-role": "user",
    "x-hasura-allowed-roles": ["user", "admin"],
    "x-hasura-user-id": "user123",
    "x-hasura-org-id": "org456"
  }
}

Required Claims:

x-hasura-default-role: Default role if not specified in request
x-hasura-allowed-roles: Array of roles user can assume
Custom claims like x-hasura-user-id for permission checks

Auth0 Integration

Auth0 Rule to add Hasura claims:

function (user, context, callback) {
  const namespace = "https://hasura.io/jwt/claims";
  context.idToken[namespace] = {
    'x-hasura-default-role': 'user',
    'x-hasura-allowed-roles': ['user'],
    'x-hasura-user-id': user.user_id
  };
  callback(null, user, context);
}

Client usage:

const token = await auth0Client.getTokenSilently();

const response = await fetch('https://my-hasura.app/v1/graphql', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ query, variables })
});

Firebase Integration

Firebase custom claims:

// Admin SDK
const admin = require('firebase-admin');

async function setCustomClaims(uid) {
  await admin.auth().setCustomUserClaims(uid, {
    'https://hasura.io/jwt/claims': {
      'x-hasura-default-role': 'user',
      'x-hasura-allowed-roles': ['user'],
      'x-hasura-user-id': uid
    }
  });
}

Webhook Mode

Alternative to JWT - Hasura calls your webhook for each request:

Webhook endpoint:

app.post('/auth-webhook', async (req, res) => {
  const authHeader = req.headers['authorization'];

  // Validate token (your logic)
  const user = await validateToken(authHeader);

  if (!user) {
    return res.status(401).json({ message: 'Unauthorized' });
  }

  // Return session variables
  res.json({
    'X-Hasura-User-Id': user.id,
    'X-Hasura-Role': user.role,
    'X-Hasura-Org-Id': user.orgId
  });
});

Hasura config:

HASURA_GRAPHQL_AUTH_HOOK=https://myapp.com/auth-webhook
HASURA_GRAPHQL_AUTH_HOOK_MODE=POST

Event Triggers

Creating Event Triggers

Event triggers invoke webhooks on database changes:

Via Console:

Navigate to Events tab
Create Trigger
Select table and operations (INSERT, UPDATE, DELETE)
Provide webhook URL
Configure retry and timeout settings

Via Metadata API:

POST /v1/metadata HTTP/1.1
Content-Type: application/json
X-Hasura-Role: admin

{
  "type": "create_event_trigger",
  "args": {
    "name": "user_created",
    "table": {
      "name": "users",
      "schema": "public"
    },
    "webhook": "https://myapp.com/webhooks/user-created",
    "insert": {
      "columns": "*"
    },
    "retry_conf": {
      "num_retries": 3,
      "interval_sec": 10,
      "timeout_sec": 60
    }
  }
}

Event Payload Structure

Webhook receives structured JSON payload:

{
  "event": {
    "session_variables": {
      "x-hasura-role": "user",
      "x-hasura-user-id": "123"
    },
    "op": "INSERT",
    "data": {
      "old": null,
      "new": {
        "id": "uuid-here",
        "email": "user@example.com",
        "created_at": "2025-01-15T10:30:00Z"
      }
    }
  },
  "created_at": "2025-01-15T10:30:00.123456Z",
  "id": "event-id",
  "trigger": {
    "name": "user_created"
  },
  "table": {
    "schema": "public",
    "name": "users"
  }
}

Event Trigger Use Cases

Send Welcome Email:

// Webhook handler
app.post('/webhooks/user-created', async (req, res) => {
  const { event } = req.body;
  const user = event.data.new;

  await sendEmail({
    to: user.email,
    subject: 'Welcome!',
    template: 'welcome',
    data: { name: user.name }
  });

  res.json({ success: true });
});

Sync to Elasticsearch:

app.post('/webhooks/product-updated', async (req, res) => {
  const { event } = req.body;
  const product = event.data.new;

  await esClient.index({
    index: 'products',
    id: product.id,
    body: product
  });

  res.json({ success: true });
});

Trigger Workflow:

app.post('/webhooks/order-placed', async (req, res) => {
  const { event } = req.body;
  const order = event.data.new;

  // Trigger payment processing
  await processPayment(order.id);

  // Notify inventory system
  await updateInventory(order.items);

  // Send confirmation email
  await sendOrderConfirmation(order);

  res.json({ success: true });
});

Actions (Custom Business Logic)

Defining Actions

Actions extend GraphQL with custom mutations and queries:

GraphQL SDL Definition:

type Mutation {
  login(username: String!, password: String!): LoginResponse
}

type LoginResponse {
  accessToken: String!
  refreshToken: String!
  user: User!
}

Action Configuration:

- name: login
  definition:
    kind: synchronous
    handler: https://myapp.com/actions/login
    forward_client_headers: true
    headers:
      - name: X-API-Key
        value: secret-key
  permissions:
    - role: anonymous

Action Handler Implementation

Express.js Handler:

app.post('/actions/login', async (req, res) => {
  const { input, session_variables } = req.body;
  const { username, password } = input;

  // Validate credentials
  const user = await validateCredentials(username, password);

  if (!user) {
    return res.status(401).json({
      message: 'Invalid credentials'
    });
  }

  // Generate tokens
  const accessToken = generateJWT(user);
  const refreshToken = generateRefreshToken(user);

  // Return action response
  res.json({
    accessToken,
    refreshToken,
    user: {
      id: user.id,
      username: user.username,
      email: user.email
    }
  });
});

Action Permissions

Control which roles can execute actions:

Via Metadata API:

POST /v1/metadata HTTP/1.1
Content-Type: application/json
X-Hasura-Role: admin

{
  "type": "create_action_permission",
  "args": {
    "action": "insertAuthor",
    "role": "user"
  }
}

Multiple Roles:

permissions:
  - role: user
  - role: admin
  - role: anonymous

Action Types

Synchronous Actions:

Client waits for response
Use for: Login, payments, validations
Timeout: Configurable (default 30s)

Asynchronous Actions:

Returns immediately with action ID
Use for: Long-running tasks, batch processing
Poll for completion or use webhooks

Advanced Action Patterns

Payment Processing:

type Mutation {
  processPayment(
    orderId: ID!
    amount: Float!
    currency: String!
    paymentMethod: String!
  ): PaymentResponse
}

type PaymentResponse {
  success: Boolean!
  transactionId: String
  error: String
}

File Upload:

type Mutation {
  uploadFile(
    file: String!  # Base64 encoded
    fileName: String!
    mimeType: String!
  ): FileUploadResponse
}

type FileUploadResponse {
  url: String!
  fileId: ID!
}

Complex Validation:

type Mutation {
  createProject(
    name: String!
    description: String!
    teamMembers: [ID!]!
  ): CreateProjectResponse
}

type CreateProjectResponse {
  project: Project
  errors: [ValidationError!]
}

type ValidationError {
  field: String!
  message: String!
}

Remote Schemas

Adding Remote Schemas

Integrate external GraphQL APIs:

Via Metadata API:

POST /v1/metadata HTTP/1.1
Content-Type: application/json
X-Hasura-Role: admin

{
  "type": "add_remote_schema",
  "args": {
    "name": "auth0_api",
    "definition": {
      "url": "https://myapp.auth0.com/graphql",
      "headers": [
        {
          "name": "Authorization",
          "value": "Bearer ${AUTH0_TOKEN}"
        }
      ],
      "forward_client_headers": false,
      "timeout_seconds": 60
    }
  }
}

Remote Schema Customization

Customize type and field names to avoid conflicts:

{
  "type": "add_remote_schema",
  "args": {
    "name": "countries",
    "definition": {
      "url": "https://countries.trevorblades.com/graphql",
      "customization": {
        "root_fields_namespace": "countries_api",
        "type_names": {
          "prefix": "Countries_",
          "suffix": "_Type"
        },
        "field_names": [
          {
            "parent_type": "Country",
            "prefix": "country_"
          }
        ]
      }
    }
  }
}

Remote Schema Permissions

Apply role-based permissions to remote schemas:

Original Remote Schema:

type User {
  id: ID!
  first_name: String!
  last_name: String!
  phone: String!
  email: String!
}

type Query {
  user(id: ID!): User
  get_users_by_name(first_name: String!, last_name: String): [User]
}

Restricted Schema for 'public' Role:

type User {
  first_name: String!
  last_name: String!
}

type Query {
  get_users_by_name(first_name: String!, last_name: String): [User]
}

Via Metadata API:

POST /v1/metadata HTTP/1.1
Content-Type: application/json
X-Hasura-Role: admin

{
  "type": "add_remote_schema_permissions",
  "args": {
    "remote_schema": "user_api",
    "role": "public",
    "definition": {
      "schema": "type User { first_name: String! last_name: String! } type Query { get_users_by_name(first_name: String!, last_name: String): [User] }"
    }
  }
}

Remote Schema Argument Presets

Automatically inject session variables into remote schema queries:

Session Variable Preset:

type Query {
  get_user(id: ID! @preset(value: "x-hasura-user-id")): User
  get_user_activities(user_id: ID!, limit: Int!): [Activity]
}

Static Value Preset:

type Query {
  get_user(id: ID! @preset(value: "x-hasura-user-id")): User
  get_user_activities(
    user_id: ID!
    limit: Int! @preset(value: 10)
  ): [Activity]
}

Literal String (not session variable):

type Query {
  hello(text: String! @preset(value: "x-hasura-hello", static: true))
}

Remote Relationships

Connect local database tables to remote schemas:

Example: Link local customer to remote payments API

SQL Table:

CREATE TABLE customer (
  id SERIAL PRIMARY KEY,
  name TEXT NOT NULL
);

Remote Schema (Payments API):

type Transaction {
  customer_id: Int!
  amount: Int!
  time: String!
  merchant: String!
}

type Query {
  transactions(customer_id: String!, limit: Int): [Transaction]
}

Remote Relationship Definition:

- table:
    name: customer
    schema: public
  remote_relationships:
    - name: customer_transactions_history
      definition:
        remote_schema: payments
        hasura_fields:
          - id
        remote_field:
          transactions:
            arguments:
              customer_id: $id

GraphQL Query with Remote Relationship:

query {
  customer {
    name
    customer_transactions_history {
      amount
      time
    }
  }
}

Production Deployment

Docker Deployment

docker-compose.yml:

version: '3.8'

services:
  postgres:
    image: postgres:15
    restart: always
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: postgrespassword
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  hasura:
    image: hasura/graphql-engine:v2.36.0
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
    restart: always
    environment:
      HASURA_GRAPHQL_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
      HASURA_GRAPHQL_ENABLE_CONSOLE: "true"
      HASURA_GRAPHQL_DEV_MODE: "true"
      HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup, http-log, webhook-log, websocket-log, query-log
      HASURA_GRAPHQL_ADMIN_SECRET: myadminsecretkey
      HASURA_GRAPHQL_JWT_SECRET: '{"type":"HS256","key":"super-secret-jwt-signing-key-min-32-chars"}'
      HASURA_GRAPHQL_UNAUTHORIZED_ROLE: anonymous

volumes:
  db_data:

Kubernetes Deployment

hasura-deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hasura
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hasura
  template:
    metadata:
      labels:
        app: hasura
    spec:
      containers:
      - name: hasura
        image: hasura/graphql-engine:v2.36.0
        ports:
        - containerPort: 8080
        env:
        - name: HASURA_GRAPHQL_DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: hasura-secrets
              key: database-url
        - name: HASURA_GRAPHQL_ADMIN_SECRET
          valueFrom:
            secretKeyRef:
              name: hasura-secrets
              key: admin-secret
        - name: HASURA_GRAPHQL_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: hasura-secrets
              key: jwt-secret
        - name: HASURA_GRAPHQL_ENABLE_CONSOLE
          value: "false"
        - name: HASURA_GRAPHQL_ENABLE_TELEMETRY
          value: "false"
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: hasura
  namespace: production
spec:
  type: ClusterIP
  selector:
    app: hasura
  ports:
  - port: 80
    targetPort: 8080

Environment Variables (Production)

Essential Production Config:

# Database
HASURA_GRAPHQL_DATABASE_URL=postgres://user:password@host:5432/dbname

# Security
HASURA_GRAPHQL_ADMIN_SECRET=strong-random-secret
HASURA_GRAPHQL_JWT_SECRET='{"type":"RS256","key":"..."}'
HASURA_GRAPHQL_UNAUTHORIZED_ROLE=anonymous

# Performance
HASURA_GRAPHQL_ENABLE_CONSOLE=false
HASURA_GRAPHQL_DEV_MODE=false
HASURA_GRAPHQL_ENABLE_TELEMETRY=false

# Logging
HASURA_GRAPHQL_ENABLED_LOG_TYPES=startup,http-log,webhook-log,websocket-log

# Rate Limiting
HASURA_GRAPHQL_RATE_LIMIT_PER_MINUTE=1000

# CORS
HASURA_GRAPHQL_CORS_DOMAIN=https://myapp.com,https://admin.myapp.com

# Connections
HASURA_GRAPHQL_PG_CONNECTIONS=50
HASURA_GRAPHQL_PG_TIMEOUT=60

Monitoring and Observability

Health Check Endpoint:

curl http://hasura:8080/healthz
# Returns: OK

Prometheus Metrics:

HASURA_GRAPHQL_ENABLE_METRICS=true
HASURA_GRAPHQL_METRICS_SECRET=metrics-secret

# Access at: http://hasura:8080/v1/metrics

Structured Logging:

HASURA_GRAPHQL_ENABLED_LOG_TYPES=startup,http-log,webhook-log,websocket-log,query-log
HASURA_GRAPHQL_LOG_LEVEL=info

APM Integration (Datadog example):

env:
  - name: HASURA_GRAPHQL_ENABLE_APM
    value: "true"
  - name: DD_AGENT_HOST
    valueFrom:
      fieldRef:
        fieldPath: status.hostIP
  - name: DD_SERVICE
    value: "hasura-graphql"
  - name: DD_ENV
    value: "production"

Migrations and Version Control

Hasura CLI Setup

Initialize Hasura project:

hasura init my-project --endpoint https://hasura.myapp.com
cd my-project

Project structure:

my-project/
├── config.yaml              # Hasura CLI config
├── metadata/                # Metadata files
│   ├── databases/
│   │   └── default/
│   │       ├── tables/
│   │       │   ├── public_users.yaml
│   │       │   └── public_posts.yaml
│   ├── actions.yaml
│   ├── remote_schemas.yaml
│   └── version.yaml
└── migrations/              # Database migrations
    └── default/
        ├── 1642531200000_create_users_table/
        │   └── up.sql
        └── 1642531300000_create_posts_table/
            └── up.sql

Creating Migrations

Via Console (auto-tracked):

# Start console with migration tracking
hasura console

# Make changes in console UI
# Migrations auto-generated in migrations/ folder

Manual migration:

# Create migration
hasura migrate create create_users_table --database-name default

# Edit generated SQL files
# migrations/default/{timestamp}_create_users_table/up.sql
# migrations/default/{timestamp}_create_users_table/down.sql

Example migration (up.sql):

CREATE TABLE public.users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email TEXT NOT NULL UNIQUE,
  username TEXT NOT NULL UNIQUE,
  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMP NOT NULL DEFAULT NOW()
);

CREATE INDEX idx_users_email ON public.users(email);
CREATE INDEX idx_users_username ON public.users(username);

Example migration (down.sql):

DROP TABLE IF EXISTS public.users CASCADE;

Applying Migrations

Apply migrations:

# Apply all pending migrations
hasura migrate apply --database-name default

# Apply specific version
hasura migrate apply --version 1642531200000 --database-name default

# Check migration status
hasura migrate status --database-name default

Exporting and Importing Metadata

Export metadata:

hasura metadata export
# Exports to metadata/ folder

Apply metadata:

hasura metadata apply
# Applies metadata from metadata/ folder

Reload metadata:

hasura metadata reload

CI/CD Integration

GitHub Actions example:

name: Deploy Hasura

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Install Hasura CLI
        run: |
          curl -L https://github.com/hasura/graphql-engine/raw/stable/cli/get.sh | bash

      - name: Apply Migrations
        env:
          HASURA_GRAPHQL_ENDPOINT: ${{ secrets.HASURA_ENDPOINT }}
          HASURA_GRAPHQL_ADMIN_SECRET: ${{ secrets.HASURA_ADMIN_SECRET }}
        run: |
          cd hasura
          hasura migrate apply --database-name default
          hasura metadata apply

      - name: Reload Metadata
        env:
          HASURA_GRAPHQL_ENDPOINT: ${{ secrets.HASURA_ENDPOINT }}
          HASURA_GRAPHQL_ADMIN_SECRET: ${{ secrets.HASURA_ADMIN_SECRET }}
        run: |
          cd hasura
          hasura metadata reload

Best Practices

Security Best Practices

Always use ADMIN_SECRET in production
- Never expose admin API without authentication
- Rotate secrets regularly
- Use strong, random secrets (min 32 characters)
Implement proper JWT validation
- Use RS256 (asymmetric) in production
- Set appropriate token expiration
- Validate issuer and audience claims
Apply least-privilege permissions
- Start with no access, add permissions as needed
- Use row-level security for all tables
- Hide sensitive columns from unauthorized roles
Disable console in production
- HASURA_GRAPHQL_ENABLE_CONSOLE=false
- Use metadata files and CLI for changes
Enable rate limiting
- Protect against DoS attacks
- Set per-role limits if needed
- Monitor and adjust based on usage
Validate webhook payloads
- Use webhook secrets for event triggers
- Validate action inputs
- Sanitize all user inputs

Performance Best Practices

Optimize database queries
- Create appropriate indexes
- Use database views for complex queries
- Leverage PostgreSQL performance tuning
Use query caching
- Enable @cached directive for expensive queries
- Set appropriate TTL values
- Cache at CDN level when possible
Limit query depth and complexity
- Set max query depth limits
- Restrict deeply nested queries
- Use pagination for large result sets
Configure connection pooling
- Tune HASURA_GRAPHQL_PG_CONNECTIONS
- Monitor connection usage
- Use PgBouncer for large deployments
Optimize subscriptions
- Use subscription multiplexing
- Limit concurrent subscriptions per client
- Consider polling for less time-sensitive data

Development Workflow Best Practices

Version control metadata
- Commit metadata/ folder to Git
- Use migrations for all schema changes
- Review metadata changes in PRs
Environment separation
- Development, staging, production environments
- Use different admin secrets per environment
- Test migrations in staging first
Testing strategy
- Test permissions thoroughly
- Integration test event triggers
- Test action handlers independently
Documentation
- Document custom actions and their inputs/outputs
- Explain complex permission rules
- Maintain API documentation for consumers
Monitoring and alerting
- Monitor query performance
- Alert on failed webhooks/event triggers
- Track error rates and latencies

Common Patterns and Examples

Pattern 1: Multi-Tenant SaaS

Schema:

CREATE TABLE organizations (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL
);

CREATE TABLE users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email TEXT NOT NULL UNIQUE,
  organization_id UUID NOT NULL REFERENCES organizations(id)
);

CREATE TABLE projects (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL,
  organization_id UUID NOT NULL REFERENCES organizations(id)
);

Permissions (users table):

{
  "filter": {
    "organization_id": {
      "_eq": "X-Hasura-Org-Id"
    }
  }
}

JWT Claims:

{
  "https://hasura.io/jwt/claims": {
    "x-hasura-default-role": "user",
    "x-hasura-allowed-roles": ["user", "org-admin"],
    "x-hasura-user-id": "user-uuid",
    "x-hasura-org-id": "org-uuid"
  }
}

Pattern 2: Social Media Application

Schema:

CREATE TABLE users (
  id UUID PRIMARY KEY,
  username TEXT UNIQUE NOT NULL,
  bio TEXT,
  avatar_url TEXT
);

CREATE TABLE posts (
  id UUID PRIMARY KEY,
  user_id UUID REFERENCES users(id),
  content TEXT NOT NULL,
  is_public BOOLEAN DEFAULT true,
  created_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE follows (
  follower_id UUID REFERENCES users(id),
  following_id UUID REFERENCES users(id),
  PRIMARY KEY (follower_id, following_id)
);

CREATE TABLE likes (
  user_id UUID REFERENCES users(id),
  post_id UUID REFERENCES posts(id),
  PRIMARY KEY (user_id, post_id)
);

Permission: View posts (user can see own posts, public posts, and posts from followed users):

{
  "filter": {
    "_or": [
      {
        "user_id": {
          "_eq": "X-Hasura-User-Id"
        }
      },
      {
        "is_public": {
          "_eq": true
        }
      },
      {
        "user": {
          "followers": {
            "follower_id": {
              "_eq": "X-Hasura-User-Id"
            }
          }
        }
      }
    ]
  }
}

Pattern 3: E-Commerce Platform

Schema:

CREATE TABLE products (
  id UUID PRIMARY KEY,
  name TEXT NOT NULL,
  price DECIMAL(10,2) NOT NULL,
  stock_quantity INT NOT NULL,
  is_active BOOLEAN DEFAULT true
);

CREATE TABLE orders (
  id UUID PRIMARY KEY,
  user_id UUID NOT NULL,
  status TEXT NOT NULL,
  total DECIMAL(10,2) NOT NULL,
  created_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE order_items (
  id UUID PRIMARY KEY,
  order_id UUID REFERENCES orders(id),
  product_id UUID REFERENCES products(id),
  quantity INT NOT NULL,
  price DECIMAL(10,2) NOT NULL
);

Event Trigger: Order confirmation email

app.post('/webhooks/order-created', async (req, res) => {
  const { event } = req.body;
  const order = event.data.new;

  // Fetch order details with items
  const orderDetails = await fetchOrderDetails(order.id);

  // Send confirmation email
  await sendEmail({
    to: orderDetails.user.email,
    template: 'order-confirmation',
    data: orderDetails
  });

  res.json({ success: true });
});

Action: Process payment

type Mutation {
  processPayment(
    orderId: ID!
    paymentMethodId: String!
  ): PaymentResponse
}

type PaymentResponse {
  success: Boolean!
  orderId: ID!
  transactionId: String
  error: String
}

Pattern 4: Real-Time Collaboration

Schema:

CREATE TABLE documents (
  id UUID PRIMARY KEY,
  title TEXT NOT NULL,
  content JSONB NOT NULL DEFAULT '{}'::jsonb,
  owner_id UUID NOT NULL,
  updated_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE document_collaborators (
  document_id UUID REFERENCES documents(id),
  user_id UUID NOT NULL,
  permission TEXT NOT NULL, -- 'read', 'write', 'admin'
  PRIMARY KEY (document_id, user_id)
);

Permission: Access documents (own or collaborated):

{
  "filter": {
    "_or": [
      {
        "owner_id": {
          "_eq": "X-Hasura-User-Id"
        }
      },
      {
        "collaborators": {
          "user_id": {
            "_eq": "X-Hasura-User-Id"
          }
        }
      }
    ]
  }
}

GraphQL Subscription: Real-time updates

subscription DocumentUpdates($documentId: uuid!) {
  documents_by_pk(id: $documentId) {
    id
    title
    content
    updated_at
  }
}

Pattern 5: Admin Dashboard with Analytics

Custom SQL Function for analytics:

CREATE OR REPLACE FUNCTION get_user_stats(user_row users)
RETURNS TABLE (
  total_posts INT,
  total_followers INT,
  total_following INT,
  engagement_rate DECIMAL
) AS $$
  SELECT
    (SELECT COUNT(*) FROM posts WHERE user_id = user_row.id)::INT,
    (SELECT COUNT(*) FROM follows WHERE following_id = user_row.id)::INT,
    (SELECT COUNT(*) FROM follows WHERE follower_id = user_row.id)::INT,
    (SELECT AVG(like_count) FROM posts WHERE user_id = user_row.id)::DECIMAL
$$ LANGUAGE SQL STABLE;

Track function in Hasura:

- function:
    name: get_user_stats
    schema: public
  configuration:
    custom_root_fields:
      function: getUserStats

GraphQL Query:

query UserWithStats {
  users {
    id
    username
    get_user_stats {
      total_posts
      total_followers
      total_following
      engagement_rate
    }
  }
}

Troubleshooting

Common Issues and Solutions

Issue: JWT validation failing

Solution:
1. Verify JWT secret configuration matches your auth provider
2. Check JWT contains required Hasura claims
3. Ensure claims are in correct namespace (https://hasura.io/jwt/claims)
4. Validate JWT hasn't expired
5. Check issuer and audience if configured

Issue: Permission denied errors

Solution:
1. Check role is in allowed_roles
2. Verify permission rules allow the operation
3. Test with admin role to isolate permission issue
4. Check session variables are being sent correctly
5. Review both row-level and column-level permissions

Issue: Event trigger not firing

Solution:
1. Check webhook is accessible from Hasura
2. Verify table name and operation match trigger config
3. Check webhook returns 200 status
4. Review event trigger logs in Hasura console
5. Ensure database triggers are enabled

Issue: Action returning errors

Solution:
1. Verify action handler URL is accessible
2. Check request/response format matches action definition
3. Review action handler logs
4. Test action handler independently
5. Verify permissions allow the role to execute action

Issue: Remote schema not loading

Solution:
1. Verify remote GraphQL endpoint is accessible
2. Check authentication headers if required
3. Test remote schema independently
4. Review timeout settings
5. Check for type name conflicts

Issue: Subscription connection dropping

Solution:
1. Check WebSocket support on hosting platform
2. Verify connection timeout settings
3. Implement reconnection logic in client
4. Check for firewall/proxy blocking WebSockets
5. Monitor connection pool limits

Additional Resources

Skill Version: 1.0.0 Last Updated: January 2025 Skill Category: Backend, GraphQL, API Development, Real-time, Database Compatible With: PostgreSQL, Auth0, Firebase, Cognito, Kubernetes, Docker

Core Concepts

Instant GraphQL API Generation

Metadata-Driven Architecture

Permission System

Authentication Integration

Event Triggers

Actions

Remote Schemas

Real-Time Subscriptions

Permission System Deep Dive

Row-Level Security

Column-Level Security

Insert Permissions

Update Permissions

Delete Permissions

Authentication Integration

JWT Mode Configuration

Auth0 Integration

Firebase Integration

Webhook Mode

Event Triggers

Creating Event Triggers

Event Payload Structure

Event Trigger Use Cases

Actions (Custom Business Logic)

Defining Actions

Action Handler Implementation

Action Permissions

Action Types

Advanced Action Patterns

Remote Schemas

Adding Remote Schemas

Remote Schema Customization

Remote Schema Permissions

Remote Schema Argument Presets

Remote Relationships

Production Deployment

Docker Deployment

Kubernetes Deployment

Environment Variables (Production)

Monitoring and Observability

Migrations and Version Control

Hasura CLI Setup

Creating Migrations

Applying Migrations

Exporting and Importing Metadata

CI/CD Integration

Best Practices

Security Best Practices

Performance Best Practices

Development Workflow Best Practices

Common Patterns and Examples

Pattern 1: Multi-Tenant SaaS

Pattern 2: Social Media Application

Pattern 3: E-Commerce Platform

Pattern 4: Real-Time Collaboration

Pattern 5: Admin Dashboard with Analytics

Troubleshooting

Common Issues and Solutions

Additional Resources

Official Documentation

Learning Resources

Community

Tools and Integrations

hasura-graphql-engine

Hasura GraphQL Engine Mastery

When to Use This Skill