# Third-Party API - Fusion

> Draft guide for operating a Fusion gateway as a third-party GraphQL API, including open-client concerns, caching strategy, and safety controls.

Canonical source: https://chillicream.com/docs/fusion/guides/third-party-api

This page is a draft.

Use this guide when your Fusion gateway is exposed to external or third-party clients that can send arbitrary queries.

Planned topics:

- Threat model and API posture for public GraphQL endpoints.
- Cache strategy for public traffic.
- Complexity and abuse protections.
- Authentication and authorization patterns.
- Operational guidance and rollout checklist.
[Edit this page on GitHub](https://github.com/ChilliCream/graphql-platform/edit/main/website/content/docs/fusion/guides/third-party-api.md)

Last updated on **June 30, 2026** by **Tobias Tengler**