GraphQL "introspection is not allowed" (disabled in production) in CI

By Daniel Zoghalchali·Latchkey

Apollo Server disables introspection by default in production (NODE_ENV=production). Any introspection query, including the one codegen or a schema-fetch step issues, is rejected, breaking CI steps that read the schema from a live URL.

What this error means

A schema fetch, codegen, or check step against the deployed endpoint fails with "GraphQL introspection is not allowed by Apollo Server, but the query contained __schema or __type."

{
  "errors": [{
    "message": "GraphQL introspection is not allowed by Apollo Server, but the query contained __schema or __type. To enable introspection, pass introspection: true to ApolloServer in production",
    "extensions": { "code": "GRAPHQL_VALIDATION_FAILED" }
  }]
}

Common causes

Introspection is off in the production build

With NODE_ENV=production and no override, Apollo Server sets introspection: false, so __schema/__type queries are blocked.

CI reads the schema from the live endpoint

A codegen or schema-check step points at the deployed URL and relies on introspection that the environment forbids.

How to fix it

Read the schema from a committed SDL artifact

1. Export the schema to an SDL file during the build.
2. Point codegen and checks at that file instead of the live endpoint.
3. Keep introspection disabled in production.

schema: ./schema.graphql   # codegen reads the artifact, not the live URL

Enable introspection only in a non-prod CI environment

If you must introspect a running server, run that instance with introspection on, not the production deployment.

new ApolloServer({
  schema,
  introspection: process.env.CI === 'true',
});

How to prevent it

• Generate an SDL artifact in CI and consume that, not the live endpoint.
• Keep introspection disabled in production for security.
• Run schema-dependent steps against a CI server that allows introspection.

Frequently asked questions

Related guides

References

• GitHub Actions documentation