Support SigV4 AuthN for "execute" introspection tool #630
Description
Hi there — our GraphQL endpoint is hosted on AWS API Gateway and requires AWS IAM authentication. IAM authentication relies on SigV4-signed requests, which means the HTTP request must include an Authorization header and other AWS-specific headers.
These headers are not static. The Authorization value is generated dynamically based on the AWS access key, secret key, session token, target service, and the exact request payload. As a result, the authorization header cannot be reused across different queries or mutations, since the request body changes each time.
I can think of two viable ways to support this:
SigV4-specific support - Apollo MCP could support SigV4 by adding explicit, SigV4-aware signing logic in the product.
Scriptable lifecycle hooks - Another approach is to allow user-defined scripts to hook into specific phases of the request lifecycle.
In my use case, the script would be triggered immediately before the execute tool runs, allowing the request to be dynamically signed (e.g., injecting SigV4 headers). More generally, this model could support additional hook points, such as post-execute scripts for response inspection, transformation, or logging.
Please let me know if I’ve missed anything, or if this capability is already supported in another way.