GraphQL can be challenging, and not only for beginners. The reason for this is often that it's so tempting to do the wrong thing. In this session, I will walk you through the various challenges of building production-ready applications with GraphQL. We will discuss the differences between a public GraphQL server and a private GraphQL server. I will show the most common mistakes people encounter with GraphQL and how to tackle them.

In this talk, we will look at persisted operations, rate-limiting, introspection security, the right defaults for paging, errors, and many more aspects. This talk is suitable for you whether you are a GraphQL server or client implementer or just a user of GraphQL. After this session, you should have a solid understanding of how to put GraphQL into production in a secure way.

The GraphQL community has come together to standardize how people can build distributed systems with GraphQL as an orchestrator. In this talk I will explain the general idea that we have for GraphQL as an Orchestrator in this space and how the new specification is tackling this. We will look at the progress we have made since last GraphQL Conf in the GraphQL composite schema working group and also get some sneak peaks at our early RFCs and prototypes. I will outline how this new specification is taking the best ideas of existing solutions in the market to make the next big leap towards mainstream adoption. This will allow anyone to build tooling by implementing the spec or parts of the spec that seamlessly integrate with other vendors.

GraphQL error handling sucks. There, I said it.

Ever hunted through the errors list to figure out if a null was legit or caused by an error? If you're like me, you gave up and now treat nulls as "maybe errored, maybe absent, maybe both."

And nullability. Schema designers make anything that might fail nullable, producing partial responses when errors occur. But since anything can fail, now everything is nullable— and we're drowning in null checks. We recklessly cast to non-null or fall back to the empty string out of desperation. And we still don't know what's truly nullable.

No more.

This talk introduces a new, pragmatic approach, born from years of work by the Nullability WG. We propose a future where schemas reflect the true nullability of business entities, and error handling is where it belongs: in your code, not your data. Use your language's built-in tools to handle errors ergonomically; and drop the unnecessary null checks. When you read a null, it should mean one thing: the absence of data.

This isn't some distant ideal on the horizon of GraphQL's future; with just 512 bytes added to your GraphQL client, you can start adopting this today. Come see how.

Everything you need to know to write maintainable GraphQL query documents—from variables and fragments to pagination patterns. Practical examples with curl and jq against a real API.