Altair GraphQL

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is more than enough, because Altair does all its work in the browser and the server only serves static files.

In the NSG, allow inbound 22/tcp from your management network and 80/tcp for the web interface. Altair serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain, using a reverse proxy or Azure Application Gateway.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for Altair GraphQL Client by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:altair-graphql-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name altair \
  --image sac1647283583153:altair-graphql-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name altair --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Altair is served by nginx on port 80. A one-shot altair-graphql-firstboot.service runs once on first boot to record the access URL. Confirm both units are active and nginx is listening on port 80:

systemctl is-active nginx altair-graphql-firstboot
sudo ss -tlnp | grep ':80 '

Expected output:

active active LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=...)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=...))

Step 5 - Confirm the app is served

nginx serves an unauthenticated /healthz endpoint for load balancer probes, and the Altair single-page app at /. The altair-static bundle is a bootstrap shell, so the image injects the AltairGraphQL.init() call the app needs to render. Confirm the health endpoint returns 200, the served page is Altair, the JavaScript module loads with a JavaScript MIME type, and the bootstrap call is present:

curl -sI http://127.0.0.1/healthz | head -1
curl -s http://127.0.0.1/ | grep -o '<title>[^<]*</title>'
curl -s -o /dev/null -w 'main.js -> HTTP %{http_code} (%{content_type})\n' http://127.0.0.1/main.js
curl -s http://127.0.0.1/ | grep -o 'AltairGraphQL.init([^<]*'

Expected output:

HTTP/1.1 200 OK <title>Altair</title> main.js -> HTTP 200 (application/javascript) AltairGraphQL.init({ baseURL: "/" });

Step 6 - Inspect the static bundle on disk

The whole appliance is the official altair-static build extracted into a single docroot: index.html alongside the assets/ directory and the versioned chunk-*.js modules:

ls -1 /var/www/altair | head -12 du -sh /var/www/altair

Expected output:

assets chunk-2OVBIND4.js chunk-35VQWODI.js ... index.html main.js polyfills.js styles.css 6.0M /var/www/altair

Step 7 - Read the per-VM access note

Altair has no login, so there is no password to retrieve. On the first boot of every VM, altair-graphql-firstboot.service resolves the VM's address and writes a short access note to a root-only file. The note tells you where to point your browser:

sudo cat /root/altair-info.txt

Expected output:

# Altair GraphQL Client appliance by sac - access information
#
# Altair is a self-hosted GraphQL IDE: build, send and inspect GraphQL queries in your
# browser. There is no login, no account and no server-side data - the app runs entirely
# in your own browser and connects to whatever GraphQL endpoint you point it at. Open the
# URL below in a web browser to start using it. altair_url=http://<vm-ip>/

The note records the VM's own address for convenience; when reaching Altair from your workstation, use the VM's public IP or DNS name.

Step 8 - Open Altair in your browser

Browse to http://<vm-public-ip>/. Altair opens as a full GraphQL IDE: a URL bar with an HTTP verb selector at the top, a query editor on the left with tabs for Query, Pre-request, Post-request and Auth, and a Result pane on the right. The left rail holds the environment, history, collections and settings.

Step 9 - Set an endpoint and write a query

Enter your GraphQL endpoint in the URL bar. This walk-through uses the public demo API https://countries.trevorblades.com/. Altair introspects the schema automatically and shows a "Reloaded doc successfully" notice. Then type a query in the editor, for example:

query CountryLookup { country(code: "GB") { name native capital currency emoji languages { name } } }

Step 10 - Send the request and read the response

Click Send Request (or press Ctrl/Cmd + Enter). Altair sends the query straight from your browser to the endpoint and renders the formatted JSON response in the Result pane, along with the HTTP status and round-trip time. The response for the query above shows the country's name, capital, currency, flag emoji and languages:

Step 11 - Explore the schema with the Docs panel

Click Docs to open the schema explorer. Altair builds it from the live introspection of the endpoint you set, so you can browse the root types, every query, mutation and subscription, their arguments and return types, and the directives the API supports. You can search across all of them. The same introspection powers the editor's autocompletion as you write:

Maintenance

• Nothing to back up: the self-hosted Altair build stores nothing on the server - your queries, history and collections live in your own browser, and every request runs client-side. The appliance is entirely stateless.
• Updating Altair: the release is pinned by sha256 for reproducibility. To move to a newer release, download the official altair-static package for the version you want, extract its build/dist/ into /var/www/altair, and keep the injected AltairGraphQL.init() bootstrap call in index.html.
• Security updates: unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.
• TLS and access control: for shared or production use, front Altair with your own domain and a TLS-terminating reverse proxy or Azure Application Gateway, and restrict port 80 in the NSG to the networks that need it.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Contact sales@secureanycloud.com. Altair GraphQL Client is licensed under the MIT License. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by the Altair project; additional charges apply for build, maintenance and 24/7 support.

Deploy on Azure

Launch Altair GraphQL Client on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

You need an AWS account, an EC2 key pair in the target region, and a VPC subnet. Altair serves static files and is light on resources. The recommended instance type is m5.large.

In the security group, allow inbound 22/tcp from your management network and 80/tcp for the IDE. Altair serves plain HTTP on port 80. For production, terminate TLS in front of it with your own certificate or an Application Load Balancer, and restrict the security group to trusted source IP ranges.

Connecting to your instance

Connect over SSH on port 22 as the default login user for the OS variant you launched:

• Ubuntu 24.04 LTS: log in as ubuntu

ssh ubuntu@<instance-public-ip>

Step 1 - Subscribe and launch from AWS Marketplace

Find the Altair GraphQL Client listing by SecureAnyCloud on AWS Marketplace. Select Continue to Subscribe, then Continue to Configuration and Continue to Launch.

Pick the Ubuntu 24.04 AMI version, an m5.large instance type, your VPC subnet and key pair, and a security group that allows 22/tcp (from your network) and 80/tcp. Then launch the instance.

To launch from the AWS CLI instead, subscribe to the product in the console first, then:

aws ec2 run-instances \
  --image-id <altair-graphql-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-allowing-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=altair-graphql}]'

Step 2 - Confirm the service is running

Altair is served by nginx, and a one-shot first-boot service prepares the per-instance login. Confirm both, and that nginx is the only public listener:

systemctl is-active nginx.service altair-graphql-firstboot.service ss -tln | grep ':80 ' test -f /var/lib/sac/data/altair-graphql-firstboot.done && echo "first boot complete"

nginx.service and altair-graphql-firstboot.service both report active, nginx is listening on :80, and the sentinel confirms first boot finished:

active active LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:* first boot complete

Step 3 - Verify the authentication gate

Altair has no login of its own, so nginx gates the app behind HTTP Basic-Auth. The public /healthz endpoint returns 200 without credentials, the app returns 401 without credentials, and 200 with the per-instance login:

curl -s -o /dev/null -w 'health: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'unauth: %{http_code}\n' http://127.0.0.1/
sudo bash -c 'U=$(grep ^ALTAIR_USERNAME= /var/lib/sac/data/altair-credentials.txt | cut -d= -f2-); P=$(grep ^ALTAIR_PASSWORD= /var/lib/sac/data/altair-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w "auth: %{http_code}\n" -u "$U:$P" http://127.0.0.1/'

You see health: 200, unauth: 401 and auth: 200 - proof the app is reachable only with the per-instance credential:

health: 200 unauth: 401 auth: 200

Step 4 - Read your per-instance login

The unique per-instance credential (username admin) is written to a root-only file on first boot. Check its mode, then read it:

sudo stat -c 'file mode: %a owner: %U:%G' /var/lib/sac/data/altair-credentials.txt

file mode: 600 owner: root:root

Read the file with sudo cat /var/lib/sac/data/altair-credentials.txt. Its contents look like this (your password is unique to your instance):

# Altair GraphQL Client 8.5.7 on Ubuntu 24.04 (sac AWS Marketplace image)
# Per-VM HTTP Basic-Auth credentials - UNIQUE to this instance, minted at first boot. ALTAIR_URL=http://<instance-public-ip>/ ALTAIR_USERNAME=admin ALTAIR_PASSWORD=<your-unique-password>

Step 5 - Open Altair

Browse to http://<instance-public-ip>/ in any modern browser. Your browser prompts for the HTTP Basic-Auth login. Enter admin and the password from Step 4. Altair opens on its main IDE view, with a GraphQL query editor on the left, a results panel on the right, and a sidebar for headers, history, variables and collections.

Step 6 - Run a query

Enter your GraphQL endpoint URL in the address bar at the top, type a query in the editor, and press Send Request (or Cmd/Ctrl + Enter). Altair sends the request straight from your browser to that endpoint and shows the formatted JSON response, the HTTP status and the round-trip time. In the example below the query { countries { code name emoji capital currency } } is run against a public GraphQL API and returns 200 with the data rendered in the results panel.

Step 7 - Explore the schema

Click Docs to open the schema documentation panel. Altair introspects the connected endpoint and lets you browse its root types, queries, mutations, fields and directives, with a search box to jump to any type. Combined with in-editor autocompletion, this makes it easy to explore an unfamiliar GraphQL API as you write.

Maintenance

• Data: Altair is client-side; every request is sent from your browser to the endpoint you choose and nothing is stored server-side. There is no database to back up.
• Change the login: the per-instance password lives in the nginx htpasswd file. To set your own, run sudo htpasswd -B /etc/nginx/.altair-htpasswd admin and follow the prompts, then sudo systemctl reload nginx.
• TLS and network: Altair serves plain HTTP on port 80; terminate TLS in front of it with your own certificate or an Application Load Balancer, and restrict the security group to trusted source IP ranges, before running it in production.
• Restart: sudo systemctl restart nginx.service if you need to bounce the web server.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Altair GraphQL Client is open-source software released under the MIT License. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by the Altair GraphQL project or its authors. This image packages the open-source Altair software for convenient deployment on AWS. All trademarks are the property of their respective holders.

Deploy on AWS

Launch Altair GraphQL Client on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com