# Build a secure GraphQL API with Node.js

**URL:** <https://devforum.okta.com/t/build-a-secure-graphql-api-with-node-js/17320>\
**Category:** Developer Blog Comments\
**Created:** [November 18, 2020, 5:18pm UTC](https://devforum.okta.com/t/build-a-secure-graphql-api-with-node-js/17320 "2020-11-18T17:18:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\
**Post date:** [November 18, 2020, 5:18pm UTC](https://devforum.okta.com/t/build-a-secure-graphql-api-with-node-js/17320/1 "2020-11-18T17:18:53Z")

</div>

[Build a secure GraphQL API with Node.js](https://developer.okta.com/blog/2020/11/18/build-a-graphql-nodejs-api)

Learn how to build a secure GraphQL API with Node.js.

---

<div class="post-metadata">

**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\
**Post date:** [November 22, 2020, 8:46pm UTC](https://devforum.okta.com/t/build-a-secure-graphql-api-with-node-js/17320/2 "2020-11-22T20:46:02Z")

</div>

**Hans**

Hello, I have a question. It seems like you set up the resource server (API) to use the client credentials to access the token introspection endpoint of the authorization server (Okta) when verifying the client’s access token (JWT). Aren’t the client credentials supposed to be used on the client instead?