It’s possible in two different ways:
-
if you use DQL, then you can issue client and admin tokens that work exactly as you described
-
using graphql, you can set up ‘@auth’ rules. You can have a shared secret that your client uses to talk to graphql. Also, you can change auth to be “default closed”, to only allow access to the apis you intend
-
(coming soon): we are building a way to lock down which operations are allowed without a token. You May then use a client token, similar to method 1 in order to access your api server to server.