When your mobile app needs a subset of what your web dashboard needs, a REST API that returns the same payload to both is doing unnecessary work on both ends.

Type definitions that model your business domain accurately rather than mirroring database tables: object types, inputs, enums, interfaces, and unions, plus queries, mutations, and subscriptions. Interface and union types handle polymorphic data in a single query, and Relay-compatible cursor pagination works natively. We review the schema before anyone writes a resolver: a naming problem caught in review takes minutes to fix, but becomes a breaking change once clients integrate.

Resolver functions for every field, with the resolver layer separated from the service layer so business logic can be tested independently and reused by REST endpoints or background jobs. Context injection provides database connections, the authenticated user, and DataLoader instances per request, errors return structured GraphQL codes with partial success, and Apollo Server plugins add request tracing and slow-field detection.

DataLoader implementation for every resolver that fetches related data, batching database calls within a single request. The N+1 problem is GraphQL's most common production failure: 50 articles with their authors means 51 queries without DataLoader, 2 with it. Instances are scoped per request, query complexity analysis and depth limiting reject queries that would generate unbounded database load, and persisted queries lock production clients to approved query hashes.

JWT or session authentication validated in GraphQL context before any resolver runs, so a failed check short-circuits the whole request. Field-level authorization with graphql-shield or custom directives lets public, partner, and admin clients share one schema while each sees only the fields their role permits. RBAC and ABAC patterns live at the resolver layer, and an unauthorized field returns a structured FORBIDDEN error for that field alone.

Subscription implementation for real-time data over WebSocket, pushing updates to connected clients instead of forcing them to poll. Built on Apollo Server with graphql-ws, authentication is validated during the WebSocket handshake, Redis-backed PubSub shares subscription events across server instances, and events filter server-side per subscription so a client watching one order receives only that order's updates.

GraphQL Playground and Apollo Sandbox for interactive schema exploration, with auth headers configured so developers test authenticated queries in the docs. Documentation lives as SDL descriptions in the schema itself, served via introspection, so it never drifts from the implementation, and Apollo Federation 2 composes multiple GraphQL services into one unified graph behind an Apollo Router gateway. Versioning uses @deprecated annotations for additive changes.