From 99f4084a0591ee764b83b0f919efc2c429227cd5 Mon Sep 17 00:00:00 2001
From: Etienne <45695613+etiennejouan@users.noreply.github.com>
Date: Fri, 19 Jun 2026 10:25:20 +0200
Subject: [PATCH] fix(front): pass auth headers to GraphiQL fetcher for
 introspection (#21821)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary
https://discord.com/channels/1130383047699738754/1517429151328374896
- The GraphiQL playground's automatic introspection query was firing
without an `Authorization` header, causing "GraphQL introspection has
been disabled" errors in production
- `defaultHeaders` only pre-fills the GraphiQL headers editor UI — it
does not inject headers into actual fetch requests
- Added `headers` to the `createGraphiQLFetcher` config so all requests
(including auto-introspection on load) are authenticated


## Test plan

- [x] Open Settings > API & Webhooks, select Core schema + GraphQL,
click Launch
- [x] Verify the introspection query in the network tab now includes the
`Authorization: Bearer ...` header
- [x] Confirm the schema explorer loads successfully in a production
environment (or with `NODE_ENV=production`)

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21821?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
---
 .../settings/playground/components/GraphQLPlayground.tsx       | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/twenty-front/src/modules/settings/playground/components/GraphQLPlayground.tsx b/packages/twenty-front/src/modules/settings/playground/components/GraphQLPlayground.tsx
index a599017c9a..06bbca026f 100644
--- a/packages/twenty-front/src/modules/settings/playground/components/GraphQLPlayground.tsx
+++ b/packages/twenty-front/src/modules/settings/playground/components/GraphQLPlayground.tsx
@@ -55,6 +55,9 @@ export const GraphQLPlayground = ({
 
   const fetcher = createGraphiQLFetcher({
     url: baseUrl,
+    headers: {
+      Authorization: `Bearer ${playgroundApiKey.token}`,
+    },
   });
 
   return (