@aws-amplify/api-graphql 4.0.2 → 4.0.3-unstable.407b52e.0

package/dist/esm/internals/types.d.ts

@@ -1,5 +1,6 @@
 import { AmplifyClassV6 } from '@aws-amplify/core';
 import { GraphQLAuthMode } from '@aws-amplify/core/internals/utils';
+import { CustomHeaders } from '@aws-amplify/data-schema-types';
 /**
  * @private
  *
@@ -14,4 +15,5 @@ export type ClientGenerationParams = {
 export type CommonPublicClientOptions = {
     authMode?: GraphQLAuthMode;
     authToken?: string;
+    headers?: CustomHeaders;
 };

package/dist/esm/internals/v6.d.ts

@@ -1,4 +1,5 @@
 import { V6Client, GraphQLOptionsV6, GraphQLResponseV6 } from '../types';
+import { CustomHeaders } from '@aws-amplify/data-schema-types';
 /**
  * Invokes graphql operations against a graphql service, providing correct input and
  * output types if Amplify-generated graphql from a recent version of the CLI/codegen
@@ -83,9 +84,7 @@ import { V6Client, GraphQLOptionsV6, GraphQLResponseV6 } from '../types';
  * @param options
  * @param additionalHeaders
  */
-export declare function graphql<FALLBACK_TYPES = unknown, TYPED_GQL_STRING extends string = string>(this: V6Client, options: GraphQLOptionsV6<FALLBACK_TYPES, TYPED_GQL_STRING>, additionalHeaders?: {
-    [key: string]: string;
-}): GraphQLResponseV6<FALLBACK_TYPES, TYPED_GQL_STRING>;
+export declare function graphql<FALLBACK_TYPES = unknown, TYPED_GQL_STRING extends string = string>(this: V6Client, options: GraphQLOptionsV6<FALLBACK_TYPES, TYPED_GQL_STRING>, additionalHeaders?: CustomHeaders): GraphQLResponseV6<FALLBACK_TYPES, TYPED_GQL_STRING>;
 /**
  * Cancels an inflight request. Only applicable for graphql queries and mutations
  * @param {any} request - request to cancel

package/dist/esm/types/index.d.ts

@@ -1,5 +1,5 @@
 import { AmplifyClassV6, ResourcesConfig } from '@aws-amplify/core';
-import { ModelTypes } from '@aws-amplify/data-schema-types';
+import { ModelTypes, CustomHeaders } from '@aws-amplify/data-schema-types';
 import { Source, DocumentNode, GraphQLError } from 'graphql';
 export { OperationTypeNode } from 'graphql';
 import { Observable } from 'rxjs';
@@ -143,9 +143,7 @@ export interface AWSAppSyncRealTimeProviderOptions {
     apiKey?: string;
     region?: string;
     graphql_headers?: () => {} | (() => Promise<{}>);
-    additionalHeaders?: {
-        [key: string]: string;
-    };
+    additionalHeaders?: CustomHeaders;
 }
 export type AWSAppSyncRealTimeProvider = {
     subscribe(options?: AWSAppSyncRealTimeProviderOptions): Observable<Record<string, unknown>>;
@@ -285,11 +283,13 @@ type ExcludeNeverFields<O> = {
 export declare const __amplify: unique symbol;
 export declare const __authMode: unique symbol;
 export declare const __authToken: unique symbol;
+export declare const __headers: unique symbol;
 export type ClientWithModels = V6Client<Record<string, any>> | V6ClientSSRRequest<Record<string, any>> | V6ClientSSRCookies<Record<string, any>>;
 export type V6Client<T extends Record<any, any> = never> = ExcludeNeverFields<{
     [__amplify]: AmplifyClassV6;
     [__authMode]?: GraphQLAuthMode;
     [__authToken]?: string;
+    [__headers]?: CustomHeaders;
     graphql: GraphQLMethod;
     cancel: (promise: Promise<any>, message?: string) => boolean;
     isCancelError: (error: any) => boolean;
@@ -299,6 +299,7 @@ export type V6ClientSSRRequest<T extends Record<any, any> = never> = ExcludeNeve
     [__amplify]: AmplifyClassV6;
     [__authMode]?: GraphQLAuthMode;
     [__authToken]?: string;
+    [__headers]?: CustomHeaders;
     graphql: GraphQLMethodSSR;
     cancel: (promise: Promise<any>, message?: string) => boolean;
     isCancelError: (error: any) => boolean;
@@ -308,17 +309,14 @@ export type V6ClientSSRCookies<T extends Record<any, any> = never> = ExcludeNeve
     [__amplify]: AmplifyClassV6;
     [__authMode]?: GraphQLAuthMode;
     [__authToken]?: string;
+    [__headers]?: CustomHeaders;
     graphql: GraphQLMethod;
     cancel: (promise: Promise<any>, message?: string) => boolean;
     isCancelError: (error: any) => boolean;
     models: ModelTypes<T, 'COOKIES'>;
 }>;
-export type GraphQLMethod = <FALLBACK_TYPES = unknown, TYPED_GQL_STRING extends string = string>(options: GraphQLOptionsV6<FALLBACK_TYPES, TYPED_GQL_STRING>, additionalHeaders?: {
-    [key: string]: string;
-} | undefined) => GraphQLResponseV6<FALLBACK_TYPES, TYPED_GQL_STRING>;
-export type GraphQLMethodSSR = <FALLBACK_TYPES = unknown, TYPED_GQL_STRING extends string = string>(contextSpec: AmplifyServer.ContextSpec, options: GraphQLOptionsV6<FALLBACK_TYPES, TYPED_GQL_STRING>, additionalHeaders?: {
-    [key: string]: string;
-} | undefined) => GraphQLResponseV6<FALLBACK_TYPES, TYPED_GQL_STRING>;
+export type GraphQLMethod = <FALLBACK_TYPES = unknown, TYPED_GQL_STRING extends string = string>(options: GraphQLOptionsV6<FALLBACK_TYPES, TYPED_GQL_STRING>, additionalHeaders?: CustomHeaders | undefined) => GraphQLResponseV6<FALLBACK_TYPES, TYPED_GQL_STRING>;
+export type GraphQLMethodSSR = <FALLBACK_TYPES = unknown, TYPED_GQL_STRING extends string = string>(contextSpec: AmplifyServer.ContextSpec, options: GraphQLOptionsV6<FALLBACK_TYPES, TYPED_GQL_STRING>, additionalHeaders?: CustomHeaders | undefined) => GraphQLResponseV6<FALLBACK_TYPES, TYPED_GQL_STRING>;
 /**
  * @private
  *
@@ -332,6 +330,7 @@ export type QueryArgs = Record<string, unknown>;
 export type ListArgs = {
     selectionSet?: string[];
     filter?: {};
+    headers?: CustomHeaders;
 };
 export type AuthModeParams = {
     authMode?: GraphQLAuthMode;

package/dist/esm/types/index.mjs

@@ -11,6 +11,7 @@ var GraphQLAuthError;
 const __amplify = Symbol('amplify');
 const __authMode = Symbol('authMode');
 const __authToken = Symbol('authToken');
+const __headers = Symbol('headers');
 
-export { GraphQLAuthError, __amplify, __authMode, __authToken };
+export { GraphQLAuthError, __amplify, __authMode, __authToken, __headers };
 //# sourceMappingURL=index.mjs.map

package/dist/esm/types/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../../src/types/index.ts"],"sourcesContent":["export { CONTROL_MSG, ConnectionState } from './PubSub';\nexport var GraphQLAuthError;\n(function (GraphQLAuthError) {\n    GraphQLAuthError[\"NO_API_KEY\"] = \"No api-key configured\";\n    GraphQLAuthError[\"NO_CURRENT_USER\"] = \"No current user\";\n    GraphQLAuthError[\"NO_CREDENTIALS\"] = \"No credentials\";\n    GraphQLAuthError[\"NO_FEDERATED_JWT\"] = \"No federated jwt\";\n    GraphQLAuthError[\"NO_AUTH_TOKEN\"] = \"No auth token specified\";\n})(GraphQLAuthError || (GraphQLAuthError = {}));\nexport const __amplify = Symbol('amplify');\nexport const __authMode = Symbol('authMode');\nexport const __authToken = Symbol('authToken');\n"],"names":[],"mappings":";;AACU,IAAC,iBAAiB;AAC5B,CAAC,UAAU,gBAAgB,EAAE;AAC7B,IAAI,gBAAgB,CAAC,YAAY,CAAC,GAAG,uBAAuB,CAAC;AAC7D,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;AAC5D,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;AAC1D,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;AAC9D,IAAI,gBAAgB,CAAC,eAAe,CAAC,GAAG,yBAAyB,CAAC;AAClE,CAAC,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;AACpC,MAAC,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE;AAC/B,MAAC,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE;AACjC,MAAC,WAAW,GAAG,MAAM,CAAC,WAAW;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../../src/types/index.ts"],"sourcesContent":["export { CONTROL_MSG, ConnectionState } from './PubSub';\nexport var GraphQLAuthError;\n(function (GraphQLAuthError) {\n    GraphQLAuthError[\"NO_API_KEY\"] = \"No api-key configured\";\n    GraphQLAuthError[\"NO_CURRENT_USER\"] = \"No current user\";\n    GraphQLAuthError[\"NO_CREDENTIALS\"] = \"No credentials\";\n    GraphQLAuthError[\"NO_FEDERATED_JWT\"] = \"No federated jwt\";\n    GraphQLAuthError[\"NO_AUTH_TOKEN\"] = \"No auth token specified\";\n})(GraphQLAuthError || (GraphQLAuthError = {}));\nexport const __amplify = Symbol('amplify');\nexport const __authMode = Symbol('authMode');\nexport const __authToken = Symbol('authToken');\nexport const __headers = Symbol('headers');\n"],"names":[],"mappings":";;AACU,IAAC,iBAAiB;AAC5B,CAAC,UAAU,gBAAgB,EAAE;AAC7B,IAAI,gBAAgB,CAAC,YAAY,CAAC,GAAG,uBAAuB,CAAC;AAC7D,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;AAC5D,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;AAC1D,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;AAC9D,IAAI,gBAAgB,CAAC,eAAe,CAAC,GAAG,yBAAyB,CAAC;AAClE,CAAC,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;AACpC,MAAC,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE;AAC/B,MAAC,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE;AACjC,MAAC,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE;AACnC,MAAC,SAAS,GAAG,MAAM,CAAC,SAAS;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@aws-amplify/api-graphql",
-	"version": "4.0.2",
+	"version": "4.0.3-unstable.407b52e.0+407b52e",
 	"description": "Api-graphql category of aws-amplify",
 	"main": "./dist/cjs/index.js",
 	"module": "./dist/esm/index.mjs",
@@ -67,7 +67,7 @@
 	},
 	"homepage": "https://aws-amplify.github.io/",
 	"devDependencies": {
-		"@aws-amplify/data-schema": "^0.11.0",
+		"@aws-amplify/data-schema": "^0.12.2",
 		"@rollup/plugin-typescript": "11.1.5",
 		"rollup": "3.29.4",
 		"typescript": "5.0.2"
@@ -79,9 +79,9 @@
 		"internals"
 	],
 	"dependencies": {
-		"@aws-amplify/api-rest": "4.0.2",
-		"@aws-amplify/core": "6.0.2",
-		"@aws-amplify/data-schema-types": "^0.4.2",
+		"@aws-amplify/api-rest": "4.0.3-unstable.407b52e.0+407b52e",
+		"@aws-amplify/core": "6.0.3-unstable.407b52e.0+407b52e",
+		"@aws-amplify/data-schema-types": "^0.6.2",
 		"@aws-sdk/types": "3.387.0",
 		"graphql": "15.8.0",
 		"rxjs": "^7.8.1",
@@ -146,5 +146,5 @@
 			"<rootDir>/__tests__"
 		]
 	},
-	"gitHead": "e9c04a6d233f812b2888aa51a71b66a4040af8c0"
+	"gitHead": "407b52ef88164023d37e2fd63cbdfde26918a2e8"
 }

package/src/GraphQLAPI.ts

@@ -4,6 +4,7 @@ import { AmplifyClassV6 } from '@aws-amplify/core';
 import { Category, ApiAction } from '@aws-amplify/core/internals/utils';
 import { GraphQLOptions, GraphQLResult } from './types';
 import { InternalGraphQLAPIClass } from './internals/InternalGraphQLAPI';
+import { CustomHeaders } from '@aws-amplify/data-schema-types';
 import { Observable } from 'rxjs';
 
 export const graphqlOperation = (
@@ -34,7 +35,7 @@ export class GraphQLAPIClass extends InternalGraphQLAPIClass {
 	graphql<T = any>(
 		amplify: AmplifyClassV6 | (() => Promise<AmplifyClassV6>),
 		options: GraphQLOptions,
-		additionalHeaders?: { [key: string]: string }
+		additionalHeaders?: CustomHeaders
 	): Observable<GraphQLResult<T>> | Promise<GraphQLResult<T>> {
 		return super.graphql(amplify, options, additionalHeaders, {
 			category: Category.API,

package/src/Providers/AWSAppSyncRealTimeProvider/index.ts

@@ -98,7 +98,11 @@ export interface AWSAppSyncRealTimeProviderOptions {
 	apiKey?: string;
 	region?: string;
 	graphql_headers?: () => {} | (() => Promise<{}>);
-	additionalHeaders?: { [key: string]: string };
+	additionalHeaders?:
+		| Record<string, string>
+		| (() => Promise<Record<string, string>>);
+	additionalCustomHeaders?: Record<string, string>;
+	authToken?: string;
 }
 
 type AWSAppSyncRealTimeAuthInput =
@@ -198,6 +202,7 @@ export class AWSAppSyncRealTimeProvider {
 			authenticationType,
 			additionalHeaders,
 			apiKey,
+			authToken,
 		} = options || {};
 
 		return new Observable(observer => {
@@ -229,6 +234,7 @@ export class AWSAppSyncRealTimeProvider {
 									appSyncGraphqlEndpoint,
 									additionalHeaders,
 									apiKey,
+									authToken,
 								},
 								observer,
 								subscriptionId,
@@ -309,8 +315,25 @@ export class AWSAppSyncRealTimeProvider {
 			region,
 			graphql_headers = () => ({}),
 			additionalHeaders = {},
+			authToken,
 		} = options;
 
+		let additionalCustomHeaders: Record<string, string> = {};
+
+		if (typeof additionalHeaders === 'function') {
+			additionalCustomHeaders = await additionalHeaders();
+		} else {
+			additionalCustomHeaders = additionalHeaders;
+		}
+
+		// if an authorization header is set, have the explicit authToken take precedence
+		if (authToken) {
+			additionalCustomHeaders = {
+				...additionalCustomHeaders,
+				Authorization: authToken,
+			};
+		}
+
 		const subscriptionState: SUBSCRIPTION_STATUS = SUBSCRIPTION_STATUS.PENDING;
 		const data = {
 			query,
@@ -336,10 +359,10 @@ export class AWSAppSyncRealTimeProvider {
 				payload: dataString,
 				canonicalUri: '',
 				region,
-				additionalHeaders,
+				additionalCustomHeaders,
 			})),
 			...(await graphql_headers()),
-			...additionalHeaders,
+			...additionalCustomHeaders,
 			[USER_AGENT_HEADER]: getAmplifyUserAgent(customUserAgentDetails),
 		};
 
@@ -365,7 +388,7 @@ export class AWSAppSyncRealTimeProvider {
 				appSyncGraphqlEndpoint,
 				authenticationType,
 				region,
-				additionalHeaders,
+				additionalCustomHeaders,
 			});
 		} catch (err: any) {
 			this._logStartSubscriptionError(subscriptionId, observer, err);
@@ -679,7 +702,7 @@ export class AWSAppSyncRealTimeProvider {
 		authenticationType,
 		apiKey,
 		region,
-		additionalHeaders,
+		additionalCustomHeaders,
 	}: AWSAppSyncRealTimeProviderOptions) {
 		if (this.socketStatus === SOCKET_STATUS.READY) {
 			return;
@@ -700,7 +723,7 @@ export class AWSAppSyncRealTimeProvider {
 						apiKey,
 						appSyncGraphqlEndpoint,
 						region,
-						additionalHeaders,
+						additionalCustomHeaders,
 					});
 
 					const headerString = authHeader ? JSON.stringify(authHeader) : '';
@@ -883,7 +906,7 @@ export class AWSAppSyncRealTimeProvider {
 		canonicalUri,
 		appSyncGraphqlEndpoint,
 		region,
-		additionalHeaders,
+		additionalCustomHeaders,
 	}: AWSAppSyncRealTimeAuthInput): Promise<
 		Record<string, unknown> | undefined
 	> {
@@ -920,7 +943,7 @@ export class AWSAppSyncRealTimeProvider {
 				apiKey: resolvedApiKey,
 				region,
 				host,
-				additionalHeaders,
+				additionalCustomHeaders,
 			});
 
 			return result;
@@ -989,14 +1012,19 @@ export class AWSAppSyncRealTimeProvider {
 
 	private _customAuthHeader({
 		host,
-		additionalHeaders,
+		additionalCustomHeaders,
 	}: AWSAppSyncRealTimeAuthInput) {
-		if (!additionalHeaders?.['Authorization']) {
+		/**
+		 * If `additionalHeaders` was provided to the subscription as a function,
+		 * the headers that are returned by that function will already have been
+		 * provided before this function is called.
+		 */
+		if (!additionalCustomHeaders?.['Authorization']) {
 			throw new Error('No auth token specified');
 		}
 
 		return {
-			Authorization: additionalHeaders.Authorization,
+			Authorization: additionalCustomHeaders.Authorization,
 			host,
 		};
 	}

package/src/internals/APIClient.ts

@@ -16,17 +16,21 @@ import {
 	ListArgs,
 	QueryArgs,
 	V6Client,
+	V6ClientSSRCookies,
 	V6ClientSSRRequest,
 	__authMode,
 	__authToken,
+	__headers,
 } from '../types';
 import { AmplifyServer } from '@aws-amplify/core/internals/adapter-core';
+import { CustomHeaders } from '@aws-amplify/data-schema-types';
 
 type LazyLoadOptions = {
 	authMode?: GraphQLAuthMode;
 	authToken?: string | undefined;
 	limit?: number | undefined;
 	nextToken?: string | undefined | null;
+	headers?: CustomHeaders | undefined;
 };
 
 const connectionType = {
@@ -778,3 +782,24 @@ export function authModeParams(
 		authToken: options.authToken || client[__authToken],
 	};
 }
+
+/**
+ * Retrieves custom headers from either the client or request options.
+ * @param {client} V6Client | V6ClientSSRRequest | V6ClientSSRCookies - for extracting client headers
+ * @param {requestHeaders} [CustomHeaders] - request headers
+ * @returns {CustomHeaders} - custom headers
+ */
+export function getCustomHeaders(
+	client: V6Client | ClientWithModels,
+	requestHeaders?: CustomHeaders
+): CustomHeaders {
+	let headers: CustomHeaders = client[__headers] || {};
+
+	// Individual request headers will take precedence over client headers.
+	// We intentionally do *not* merge client and request headers.
+	if (requestHeaders) {
+		headers = requestHeaders;
+	}
+
+	return headers;
+}

package/src/internals/InternalGraphQLAPI.ts

@@ -29,6 +29,7 @@ import {
 	updateRequestToBeCancellable,
 } from '@aws-amplify/api-rest/internals';
 import { AWSAppSyncRealTimeProvider } from '../Providers/AWSAppSyncRealTimeProvider';
+import { CustomHeaders } from '@aws-amplify/data-schema-types';
 import { resolveConfig, resolveLibraryOptions } from '../utils';
 
 const USER_AGENT_HEADER = 'x-amz-user-agent';
@@ -66,9 +67,8 @@ export class InternalGraphQLAPIClass {
 	private async _headerBasedAuth(
 		amplify: AmplifyClassV6,
 		authMode: GraphQLAuthMode,
-		additionalHeaders: { [key: string]: string } = {}
+		additionalHeaders: Record<string, string> = {}
 	) {
-		const config = amplify.getConfig();
 		const {
 			region: region,
 			endpoint: appSyncGraphqlEndpoint,
@@ -114,9 +114,13 @@ export class InternalGraphQLAPIClass {
 				}
 				break;
 			case 'lambda':
-				if (!additionalHeaders.Authorization) {
+				if (
+					typeof additionalHeaders === 'object' &&
+					!additionalHeaders.Authorization
+				) {
 					throw new Error(GraphQLAuthError.NO_AUTH_TOKEN);
 				}
+
 				headers = {
 					Authorization: additionalHeaders.Authorization,
 				};
@@ -155,7 +159,7 @@ export class InternalGraphQLAPIClass {
 			| AmplifyClassV6
 			| ((fn: (amplify: any) => Promise<any>) => Promise<AmplifyClassV6>),
 		{ query: paramQuery, variables = {}, authMode, authToken }: GraphQLOptions,
-		additionalHeaders?: { [key: string]: string },
+		additionalHeaders?: CustomHeaders,
 		customUserAgentDetails?: CustomUserAgentDetails
 	): Observable<GraphQLResult<T>> | Promise<GraphQLResult<T>> {
 		const query =
@@ -171,11 +175,6 @@ export class InternalGraphQLAPIClass {
 
 		const headers = additionalHeaders || {};
 
-		// if an authorization header is set, have the explicit authToken take precedence
-		if (authToken) {
-			headers.Authorization = authToken;
-		}
-
 		switch (operationType) {
 			case 'query':
 			case 'mutation':
@@ -189,7 +188,8 @@ export class InternalGraphQLAPIClass {
 						{ query, variables, authMode },
 						headers,
 						abortController,
-						customUserAgentDetails
+						customUserAgentDetails,
+						authToken
 					);
 				} else {
 					const wrapper = (amplifyInstance: AmplifyClassV6) =>
@@ -198,7 +198,8 @@ export class InternalGraphQLAPIClass {
 							{ query, variables, authMode },
 							headers,
 							abortController,
-							customUserAgentDetails
+							customUserAgentDetails,
+							authToken
 						);
 
 					responsePromise = amplify(wrapper) as unknown as Promise<
@@ -216,7 +217,8 @@ export class InternalGraphQLAPIClass {
 					amplify as AmplifyClassV6,
 					{ query, variables, authMode },
 					headers,
-					customUserAgentDetails
+					customUserAgentDetails,
+					authToken
 				);
 			default:
 				throw new Error(`invalid operation type: ${operationType}`);
@@ -226,9 +228,10 @@ export class InternalGraphQLAPIClass {
 	private async _graphql<T = any>(
 		amplify: AmplifyClassV6,
 		{ query, variables, authMode }: GraphQLOptions,
-		additionalHeaders = {},
+		additionalHeaders: CustomHeaders = {},
 		abortController: AbortController,
-		customUserAgentDetails?: CustomUserAgentDetails
+		customUserAgentDetails?: CustomUserAgentDetails,
+		authToken?: string
 	): Promise<GraphQLResult<T>> {
 		const {
 			region: region,
@@ -237,14 +240,45 @@ export class InternalGraphQLAPIClass {
 			customEndpointRegion,
 		} = resolveConfig(amplify);
 
-		// Retrieve library options from Amplify configuration
+		/**
+		 * Retrieve library options from Amplify configuration.
+		 * `customHeaders` here are from the Amplify configuration options,
+		 * and are for non-AppSync endpoints only. These are *not* the same as
+		 * `additionalHeaders`, which are custom headers that are either 1)
+		 * included when configuring the API client or 2) passed along with
+		 * individual requests.
+		 */
 		const { headers: customHeaders, withCredentials } =
 			resolveLibraryOptions(amplify);
 
+		/**
+		 * Client or request-specific custom headers that may or may not be
+		 * returned by a function:
+		 */
+		let additionalCustomHeaders: Record<string, string>;
+
+		if (typeof additionalHeaders === 'function') {
+			additionalCustomHeaders = await additionalHeaders();
+		} else {
+			additionalCustomHeaders = additionalHeaders;
+		}
+
+		// if an authorization header is set, have the explicit authToken take precedence
+		if (authToken) {
+			additionalCustomHeaders = {
+				...additionalCustomHeaders,
+				Authorization: authToken,
+			};
+		}
+
 		// TODO: Figure what we need to do to remove `!`'s.
 		const headers = {
 			...(!customEndpoint &&
-				(await this._headerBasedAuth(amplify, authMode!, additionalHeaders))),
+				(await this._headerBasedAuth(
+					amplify,
+					authMode!,
+					additionalCustomHeaders
+				))),
 			/**
 			 * Custom endpoint headers.
 			 * If there is both a custom endpoint and custom region present, we get the headers.
@@ -253,7 +287,11 @@ export class InternalGraphQLAPIClass {
 			 */
 			...((customEndpoint &&
 				(customEndpointRegion
-					? await this._headerBasedAuth(amplify, authMode!, additionalHeaders)
+					? await this._headerBasedAuth(
+							amplify,
+							authMode!,
+							additionalCustomHeaders
+					  )
 					: {})) ||
 				{}),
 			// Custom headers included in Amplify configuration options:
@@ -262,8 +300,8 @@ export class InternalGraphQLAPIClass {
 					query: print(query as DocumentNode),
 					variables,
 				}))),
-			// Headers from individual calls to `graphql`:
-			...additionalHeaders,
+			// Custom headers from individual requests or API client configuration:
+			...additionalCustomHeaders,
 			// User agent headers:
 			...(!customEndpoint && {
 				[USER_AGENT_HEADER]: getAmplifyUserAgent(customUserAgentDetails),
@@ -379,8 +417,9 @@ export class InternalGraphQLAPIClass {
 	private _graphqlSubscribe(
 		amplify: AmplifyClassV6,
 		{ query, variables, authMode }: GraphQLOptions,
-		additionalHeaders = {},
-		customUserAgentDetails?: CustomUserAgentDetails
+		additionalHeaders: CustomHeaders = {},
+		customUserAgentDetails?: CustomUserAgentDetails,
+		authToken?: string
 	): Observable<any> {
 		const config = resolveConfig(amplify);
 
@@ -393,6 +432,7 @@ export class InternalGraphQLAPIClass {
 				authenticationType: authMode || config?.defaultAuthMode,
 				apiKey: config?.apiKey,
 				additionalHeaders,
+				authToken,
 			},
 			customUserAgentDetails
 		);

package/src/internals/generateClient.ts

@@ -2,7 +2,13 @@
 // SPDX-License-Identifier: Apache-2.0
 import { graphql, cancel, isCancelError } from './v6';
 import { generateModelsProperty } from './generateModelsProperty';
-import { V6Client, __amplify, __authMode, __authToken } from '../types';
+import {
+	V6Client,
+	__amplify,
+	__authMode,
+	__authToken,
+	__headers,
+} from '../types';
 import { ClientGenerationParams } from './types';
 
 /**
@@ -21,6 +27,7 @@ export function generateClient<T extends Record<any, any> = never>(
 		[__amplify]: params.amplify,
 		[__authMode]: params.authMode,
 		[__authToken]: params.authToken,
+		[__headers]: params.headers,
 		graphql,
 		cancel,
 		isCancelError,

package/src/internals/operations/get.ts

@@ -8,6 +8,7 @@ import {
 	flattenItems,
 	authModeParams,
 	ModelOperation,
+	getCustomHeaders,
 } from '../APIClient';
 import {
 	AuthModeParams,
@@ -80,6 +81,9 @@ async function _get(
 
 	try {
 		const auth = authModeParams(client, options);
+
+		const headers = getCustomHeaders(client, options?.headers);
+
 		const { data, extensions } = context
 			? ((await (client as V6ClientSSRRequest<Record<string, any>>).graphql(
 					context,
@@ -87,13 +91,17 @@ async function _get(
 						...auth,
 						query,
 						variables,
-					}
+					},
+					headers
 			  )) as GraphQLResult<any>)
-			: ((await (client as V6Client<Record<string, any>>).graphql({
-					...auth,
-					query,
-					variables,
-			  })) as GraphQLResult<any>);
+			: ((await (client as V6Client<Record<string, any>>).graphql(
+					{
+						...auth,
+						query,
+						variables,
+					},
+					headers
+			  )) as GraphQLResult<any>);
 
 		// flatten response
 		if (data) {

package/src/internals/operations/list.ts

@@ -7,6 +7,7 @@ import {
 	buildGraphQLVariables,
 	flattenItems,
 	authModeParams,
+	getCustomHeaders,
 } from '../APIClient';
 import {
 	AuthModeParams,
@@ -66,6 +67,8 @@ async function _list(
 	try {
 		const auth = authModeParams(client, args);
 
+		const headers = getCustomHeaders(client, args?.headers);
+
 		const { data, extensions } = !!contextSpec
 			? ((await (client as V6ClientSSRRequest<Record<string, any>>).graphql(
 					contextSpec,
@@ -73,13 +76,17 @@ async function _list(
 						...auth,
 						query,
 						variables,
-					}
+					},
+					headers
 			  )) as GraphQLResult<any>)
-			: ((await (client as V6Client<Record<string, any>>).graphql({
-					...auth,
-					query,
-					variables,
-			  })) as GraphQLResult<any>);
+			: ((await (client as V6Client<Record<string, any>>).graphql(
+					{
+						...auth,
+						query,
+						variables,
+					},
+					headers
+			  )) as GraphQLResult<any>);
 
 		// flatten response
 		if (data !== undefined) {

package/src/internals/operations/subscription.ts

@@ -9,6 +9,7 @@ import {
 	buildGraphQLVariables,
 	authModeParams,
 	ModelOperation,
+	getCustomHeaders,
 } from '../APIClient';
 import {
 	ModelIntrospectionSchema,
@@ -38,11 +39,16 @@ export function subscriptionFactory(
 
 		const auth = authModeParams(client, args);
 
-		const observable = client.graphql({
-			...auth,
-			query,
-			variables,
-		}) as GraphqlSubscriptionResult<object>;
+		const headers = getCustomHeaders(client, args?.headers);
+
+		const observable = client.graphql(
+			{
+				...auth,
+				query,
+				variables,
+			},
+			headers
+		) as GraphqlSubscriptionResult<object>;
 
 		return observable.pipe(
 			map(value => {