> Speaking of which, if you're really determined to use GraphQL as your API, please be ready to charge a few sats per API call.  Because if not some moronic idiot is going to think it's funny to flood the site with compute-expensive calls.

we've considered it. we're going to do it when it's needed :)

so enjoy the free ride as long as it's possible :)

> I probably can't convince you that exposing GraphQL to anonymous callers is a bad idea, so hopefully I can convince you to be ready with something less awful than (a)(b)(c)(d) when the inevitable result occurs.

no, you can, you actually don't even have to because i already somewhat agree :)

we're aware that GraphQL is vulnerable to [n+1 queries](https://hygraph.com/blog/graphql-n-1-problem) and some malicious actor ... not going to continue for hopefully obvious reasons :)

> Now do some PoW or wait until we're ready :)

Speaking of which, if you're really determined to use GraphQL as your API, please be ready to charge a few sats per API call.  Because if not some moronic idiot is going to think it's funny to flood the site with compute-expensive calls.

*Every* site I know of that exposes a GraphQL API is eventually forced to either (a) put users through CAPTCHA-hell (b) do browser fingerprinting, usually via cloudflare, (c) some kind of real-world identity linkage like SMS verification, or (d) some combination of the above.

I would hate to see that happen to SN.

I probably can't convince you that exposing GraphQL to anonymous callers is a bad idea, so hopefully I can convince you to be ready with something less awful than (a)(b)(c)(d) when the inevitable result occurs.

Thanks again for creating this awesome site.

anon

yes yes, you are right, i forgot about this :)

i think i am using ":)" so much it might actually start looking like i mean it in a "sarcastic way", lol

>  You don't need a browser

I sure looks like you *do*:

> SN_AUTH_COOKIE must be set with a valid session cookie.

> Some functions need authentication. Right now this is handled by pasting you session cookie into a .env file under SN_AUTH_COOKIE.  How to Retrieve a Cookie from a Web Request: Open Developer Tools ...



It's GraphQL. **You don't need a browser.** I said you can _even_ use it from your browser.

The playground is there to make it easy to get into. **To just play around initially.**

If you want the GraphQL API schema in plaintext, it's [here](https://github.com/stackernews/stacker.news/tree/master/api/typeDefs).

Now do some PoW or wait until we're ready :)

wen HN parity?  i was told there would be a lambo API.

The whole point is to *not need a browser*.