Skip to main content

Public vs authenticated data

Propeller's GraphQL API returns different data depending on whether the request includes an authenticated session. Understanding which data is public and which is session-dependent helps you decide what to cache, pre-render or fetch per request.

Public data​

Public data is the same for every visitor, whether anonymous or logged in. This includes:

  • Product catalog: names, descriptions, SKUs, attributes and media
  • Categories: the full category tree and navigation structure
  • Default prices: the list price (priceData.list) and suggested price (priceData.suggested)
  • Product search and filtering: search results when not restricted by orderlists

This data is safe to cache, statically generate or serve from a CDN. It does not depend on who is viewing it.

Session-dependent data​

Session-dependent data changes based on the authenticated user. This data must be fetched per request with the user's session context.

Prices​

Authenticated users who belong to a company with a price sheet see different prices than anonymous users. The price field automatically reflects the applicable price sheet when queried with an authenticated session. The price.type field tells you where the price came from:

  • DEFAULT for anonymous users or users without a price sheet (the list price)
  • PRICESHEET for users with customer-specific pricing

Anonymous users always see the list price. See Customer-specific pricing for details.

Product visibility​

In B2B, orderlists control which products are visible and orderable for a specific company. When you query products with applyOrderlists: true, only products assigned to the company's orderlists are returned. Anonymous users without orderlist filtering see the full catalog. See Querying products for how to apply orderlist filtering.

Cart​

Carts belong to the current session. An anonymous session has its own cart. When a user logs in, the cart is associated with their account. Cart data is always session-scoped and cannot be cached across users. See Cart management for details.

Favorite lists​

Favorite lists belong to a contact, customer or company. They are only accessible when authenticated. See Favorite lists for how favorite list ownership works.

Order history​

Orders are only visible to authenticated users. In B2B, orders can be filtered by company so that a procurement manager sees all orders placed by any contact in the company. See Order history for listing and filtering orders.

Account data​

The viewer query returns the current user's identity. For authenticated users, it returns a Contact (B2B) or Customer (B2C) with their profile data. For anonymous users, the response indicates that no user is logged in.

Detecting authentication state​

Use the viewer query to determine whether the current session is authenticated:

query {
  viewer {
    __typename
    isLoggedIn
  }
}

When isLoggedIn is true, the user has an active session and you can fetch session-dependent data. The __typename field returns Contact for B2B users or Customer for B2C users, which determines what account features to show.

See Authentication and authorization for the full viewer query and response examples.

Practical implications​

Catalog pages can be built with public data for fast initial loads. Product names, descriptions, images, categories and default prices are all public. Cache or pre-render these freely.

Personalized data (customer-specific prices, orderlist-filtered products) should be loaded once the user's session is known. A common approach is to render the catalog page with list prices first, then replace them with the customer's prices after authentication is confirmed.

"Log in for your price" is a pattern used in B2B storefronts where prices vary significantly between customers. Check price.type: when it returns DEFAULT, the visitor is seeing the list price. When it returns PRICESHEET, they are seeing their negotiated price. Some B2B storefronts hide prices entirely for anonymous visitors and show a login prompt instead.

Cart and account pages always require session context. There is no public fallback for these.

Next steps​