Using Apollo Server, I get around authentication with an auth query which updates the context object of the query with the auth token of the user. Then, any subsequent queries can use that auth token to authenticate the user and authorize it for the query themselves.

I've also seen it where the authentication is handled by middleware before GraphQL even touches the request. I figure those two methods work for about every use case.