# Apollo Router to Subgraph Authentication Self Hosted

**URL:** <https://community.apollographql.com/t/apollo-router-to-subgraph-authentication-self-hosted/7840>\
**Category:** Router\
**Tags:** router\
**Created:** [September 20, 2024, 1:55pm UTC](https://community.apollographql.com/t/apollo-router-to-subgraph-authentication-self-hosted/7840 "2024-09-20T13:55:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zeffzenn](https://avatars.discourse-cdn.com/v4/letter/z/8baadc/32.png) [@zeffzenn](https://community.apollographql.com/u/zeffzenn)\
**Post date:** [September 20, 2024, 1:55pm UTC](https://community.apollographql.com/t/apollo-router-to-subgraph-authentication-self-hosted/7840/1 "2024-09-20T13:55:56Z")

</div>

Hello,  
I am looking for a solution for server-side authentication between the Apollo router and self-hosted subgraphs. I see there is documentation for this for AWS hosted subgraphs using SigV4 but how would I accomplish this without using AWS?

Reference: [Subgraph Authentication - Apollo GraphQL Docs](https://www.apollographql.com/docs/router/configuration/authn-subgraph/)

---

<div class="post-metadata">

**Author:** ![dylan](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/dylan/32/6009_2.png) [@dylan](https://community.apollographql.com/u/dylan)\
**Post date:** [September 20, 2024, 3:20pm UTC](https://community.apollographql.com/t/apollo-router-to-subgraph-authentication-self-hosted/7840/2 "2024-09-20T15:20:23Z")

</div>

A couple of other options:

1. Use [mTLS](https://www.apollographql.com/docs/router/configuration/overview/#tls-client-authentication-for-subgraph-requests)
2. I can’t find a documented pattern for it, but all of our [subgraph templates](https://www.apollographql.com/docs/rover/commands/template/#listing-available-templates) come set up to check a header from the router that contains a shared secret. This is a one-sided auth, the subgraph verifies that it’s the router that’s calling.