Extensibility: APIs

Meshery’s APIs

Each of Meshery’s APIs are subject to the following authentication and authorization system.


Requests to any of the API endpoints must be authenticated and include a valid JWT access token in the HTTP headers. Type of authentication is determined by the selected Provider. Use of the Local Provider, “None”, puts Meshery into single-user mode and does not require authentication.

What are authentication tokens?


Currently, Meshery only requires a valid token in order to allow clients to invoke its APIs.


Each of the API endpoints are exposed through server.go. Endpoints are grouped by function (e.g. /api/mesh or /api/perf).

Alternatively, Remote Providers can extend Meshery’s endpoints behind the /api/extensions/ endpoint.

How to get your token

There are two ways to get your authentication token:

  1. Meshery UI
  2. Meshery CLI

Using Meshery UI, you can get a copy of your authentication token by following these steps:

  1. Log into Meshery by selecting your identity provider of choice (typically found at http:<meshery-server>:9081/provider)
  2. Navigate to your user’s avatar in the upper lefthand corner and select “Get Token” from the dropdown of profile section.

Using Meshery CLI, you can get a copy of your authentication token by executing this command:

mesheryctl system login

In order to use this command, you must have a web browser available on your system (this command cannot be executed on a headless system).


Meshery provides its GraphQl API at hostname:9081/api/graphql/query. A GraphQL request can be made as a POST request to the endpoint with the query as the payload.

Explore the Meshery GraphQL API using the interactive Playground provided with Meshery instance at localhost:9081/api/system/graphql/playground.

Meshery GraphQL API can be used to perform three operations:

  • Queries for data retrieval.
  • Mutations for creating, updating, and deleting data.
  • Subscriptions for watching for any data changes.


Meshery provides a REST API available through the default port of 9081/tcp.

See Also