On OpenAPI vs GraphQL: I disagree with the premise that OpenAPI achieves the same thing. GraphQL is necessarily tightly coupled to your backend — you can't design a schema that does something other than what's actually implemented. OpenAPI, on the other hand... I've seen countless implementors get it wrong. Specs drift from reality, documentation lies, and you're trusting convention. Sure, OpenAPI can do whatever you want, but for those of us who prefer convention over configuration, GraphQL's enforced contract is the whole point.
On authentication concerns: Yes, auth in GraphQL has varied implementations with no open standard. But REST doesn't thrive here either... it's all bespoke. This is a tooling problem, not a GraphQL problem. Resolvers become your authorization boundary the same way endpoints with controller actions do in REST. Different shape, same responsibility.
On type generation: In my experience, the codegen tooling with Apollo and Relay is incredible. I haven't seen anything on the OpenAPI side that comes close to that developer experience.
> Specs drift from reality
This is only an issue if the spec is maintained manually. In my opinion, best practice is to generate the specification from the actual implementation—assuming you didn’t start by hand-crafting the spec in the first place.
If the spec is the source of truth, server and client stubs can be generated from it, which should likewise prevent this kind of drift.
I realize that working with OpenAPI isn’t always straightforward, but most of the friction usually comes down to gaps in understanding or insufficient tooling for a given tech stack.
If you know it's a glued-together solution that you'll have to rip apart if your program scales, why make it so complex in the first place?
You can utilize any mailing library in your backend to simply send emails or choose API email providers like Resend or Mailgun.
For spam protection, various providers are available, such as Cloudflare and Google.
> why make it so complex in the first place?
You're completely justified in questioning this, and I resonate with you and all the developers who feel the same way.