diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2660533..0b97b09e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Changed
+
+- Migrate GraphQL builder from `graphql@1.x` to `graphql@2.x`
+
 ## [2.176.0] - 2026-05-07
 
 ### Fixed
diff --git a/graphql/schema.graphql b/graphql/schema.graphql
index bd7ddd5f..5c9d02d8 100644
--- a/graphql/schema.graphql
+++ b/graphql/schema.graphql
@@ -20,6 +20,7 @@ type Query {
     """
     identifier: ProductUniqueIdentifier
   ): Product
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -73,6 +74,7 @@ type Query {
     """
     hideUnavailableItems: Boolean = false
   ): ProductSearch
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -87,6 +89,7 @@ type Query {
     """
     map: String = ""
   ): SearchMetadata
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -140,6 +143,7 @@ type Query {
     """
     hideUnavailableItems: Boolean = false
   ): [Product]
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -148,6 +152,7 @@ type Query {
     identifier: ProductUniqueIdentifier
     type: CrossSelingInputEnum
   ): [Product]
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -156,6 +161,7 @@ type Query {
     field: ProductUniqueIdentifierField!
     values: [ID!]
   ): [Product]
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -182,6 +188,7 @@ type Query {
     """
     hideUnavailableItems: Boolean = false
   ): Facets
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -235,6 +242,7 @@ type Query {
     """
     to: Int = 9
   ): Search
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: SHORT)
     @withSegment
     @deprecated(reason: "Use the 'products' and 'facets' queries separately")
@@ -247,7 +255,7 @@ type Query {
     Category id
     """
     id: Int @coerce
-  ): Category @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
+  ): Category @auth(scope: PUBLIC) @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
 
   """
   Returns categories tree
@@ -257,7 +265,9 @@ type Query {
     Category tree level. Default: 3
     """
     treeLevel: Int = 3 @coerce
-  ): [Category] @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
+  ): [Category]
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
 
   """
   Returns a specified brand
@@ -267,12 +277,14 @@ type Query {
     Brand id
     """
     id: Int @coerce
-  ): Brand @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
+  ): Brand @auth(scope: PUBLIC) @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
 
   """
   Returns brands list
   """
-  brands: [Brand] @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
+  brands: [Brand]
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
 
   """
   Returns orderForm shipping simulation
@@ -295,6 +307,7 @@ type Query {
     """
     country: String
   ): ShippingData
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
     @withSegment
     @withOrderFormId
@@ -304,6 +317,7 @@ type Query {
   Returns checkout cart details
   """
   orderForm: OrderForm
+    @auth(scope: PUBLIC)
     @cacheControl(maxAge: ZERO, scope: PRIVATE)
     @withOrderFormId
     @withOwnerId
@@ -313,6 +327,7 @@ type Query {
   returns a certain checkout cart details
   """
   searchOrderForm(orderFormId: String!): OrderForm
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
     @withOwnerId
 
@@ -320,6 +335,7 @@ type Query {
   DEPRECATED
   """
   orders: [Order]
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
     @withOrderFormId
     @deprecated(reason: "Use orders endpoint of vtex.orders-graphql instead")
@@ -327,12 +343,13 @@ type Query {
   """
   Returns a specified user order
   """
-  order(id: String!): Order @cacheControl(scope: PRIVATE)
+  order(id: String!): Order @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Returns the specified store configurations
   """
-  storeConfigs: StoreConfigs
+  storeConfigs: StoreConfigs @auth(scope: PUBLIC)
+
   """
   Returns user profile details
   """
@@ -341,7 +358,10 @@ type Query {
     Comma separated fields
     """
     customFields: String
-  ): Profile @cacheControl(scope: PRIVATE) @withCurrentProfile
+  ): Profile
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
+    @withCurrentProfile
 
   """
   Get auto complete suggestions in search
@@ -356,6 +376,7 @@ type Query {
     """
     searchTerm: String
   ): Suggestions
+    @auth(scope: PUBLIC)
     @cacheControl(scope: SEGMENT, maxAge: MEDIUM)
     @withSegment
     @deprecated(reason: "Use the query defined in the search-graphql app")
@@ -396,7 +417,7 @@ type Query {
     Defines which account will be required
     """
     account: String
-  ): [Document] @cacheControl(scope: PUBLIC, maxAge: SHORT)
+  ): [Document] @auth(scope: PUBLIC) @cacheControl(scope: PUBLIC, maxAge: SHORT)
 
   """
   Get document
@@ -418,7 +439,7 @@ type Query {
     Defines in which account the request will be made
     """
     account: String
-  ): Document @cacheControl(scope: PUBLIC, maxAge: SHORT)
+  ): Document @auth(scope: PUBLIC) @cacheControl(scope: PUBLIC, maxAge: SHORT)
 
   """
   Get a document schema
@@ -432,7 +453,8 @@ type Query {
     MasterData schema name.
     """
     schema: String
-  ): DocumentSchema
+  ): DocumentSchema @auth(scope: PUBLIC)
+
   documentPublicSchema(
     """
     Data entity name.
@@ -442,7 +464,7 @@ type Query {
     MasterData schema name.
     """
     schema: String!
-  ): DocumentSchemaV2 @cacheControl(scope: PUBLIC)
+  ): DocumentSchemaV2 @auth(scope: PUBLIC) @cacheControl(scope: PUBLIC)
 
   """
   Get the benefits associated with a list of products
@@ -452,17 +474,24 @@ type Query {
     List of Products
     """
     items: [ShippingItem]
-  ): [Benefit] @cacheControl(scope: SEGMENT, maxAge: SHORT) @withSegment
+  ): [Benefit]
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: SEGMENT, maxAge: SHORT)
+    @withSegment
 
   """
   Get the options available to authenticate users
   """
-  loginOptions: LoginOptions @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
+  loginOptions: LoginOptions
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
 
   """
   Get an object containing the list of the user's loginSessions
   """
-  loginSessionsInfo: LoginSessionsInfo @cacheControl(scope: PRIVATE)
+  loginSessionsInfo: LoginSessionsInfo
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
 
   """
   Get the IDs for the provided search context slugs
@@ -472,7 +501,9 @@ type Query {
     department: String
     category: String
     subcategory: String
-  ): SearchContext @deprecated(reason: "Use the 'pageType' query")
+  ): SearchContext
+    @auth(scope: PUBLIC)
+    @deprecated(reason: "Use the 'pageType' query")
 
   """
   Get search page type
@@ -486,12 +517,14 @@ type Query {
     URL's querystring including '?'
     """
     query: String
-  ): PageType @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
+  ): PageType @auth(scope: PUBLIC) @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
 
   """
   Get logistics information about the store
   """
-  logistics: LogisticsData @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
+  logistics: LogisticsData
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PUBLIC, maxAge: MEDIUM)
 
   """
   Get a list of pickup points near specified lat and long
@@ -509,14 +542,16 @@ type Query {
     max distance of pickup points from given coordinates, in kilometers, default value 50
     """
     maxDistance: Int = 50
-  ): NearPickupPointQueryResponse
+  ): NearPickupPointQueryResponse @auth(scope: PUBLIC)
+
   skuPickupSLAs(
     itemId: String @coerce
     seller: String @coerce
     lat: String @coerce
     long: String @coerce
     country: String
-  ): [CheckoutSLA]
+  ): [CheckoutSLA] @auth(scope: PUBLIC)
+
   skuPickupSLA(
     itemId: String @coerce
     seller: String @coerce
@@ -524,15 +559,17 @@ type Query {
     long: String @coerce
     country: String
     pickupId: String @coerce
-  ): CheckoutSLA
+  ): CheckoutSLA @auth(scope: PUBLIC)
+
   """
   Get pickup point by its id
   """
-  pickupPoint(id: String!): PickupPoint
+  pickupPoint(id: String!): PickupPoint @auth(scope: PUBLIC)
+
   """
   Get profile information to session users
   """
-  getSession: Session @cacheControl(scope: PRIVATE)
+  getSession: Session @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Get the Wish List informations by the received id
@@ -542,7 +579,8 @@ type Query {
     The list document id
     """
     id: ID
-  ): List
+  ): List @auth(scope: PUBLIC)
+
   """
   Get all lists from the received owner
   """
@@ -559,25 +597,34 @@ type Query {
     The page size
     """
     pageSize: Int = 15
-  ): [List]
+  ): [List] @auth(scope: PUBLIC)
+
   """
   Get logged in user's last order
   """
-  userLastOrder: Order @cacheControl(scope: PRIVATE)
+  userLastOrder: Order @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
-  checkProfileAllowed: UserCondition @cacheControl(scope: PRIVATE) @withSegment
+  checkProfileAllowed: UserCondition
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
+    @withSegment
 
   itemsWithSimulation(
     items: [ItemInput]
     regionId: String
     salesChannel: String
     postalCode: String
-  ): [SKU] @cacheControl(scope: SEGMENT, maxAge: SHORT) @withSegment
+  ): [SKU]
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: SEGMENT, maxAge: SHORT)
+    @withSegment
 
   """
   Returns information about the currently authenticated user
   """
-  authenticatedUser: AuthenticatedUserInfo @cacheControl(scope: PRIVATE)
+  authenticatedUser: AuthenticatedUserInfo
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
 }
 
 type Mutation {
@@ -604,14 +651,14 @@ type Mutation {
     Optional marketing UTMi Params to add them to order form
     """
     utmiParams: OrderFormInputUTMIParams
-  ): OrderForm @withSegment @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withSegment @withOrderFormId @withOwnerId
   cancelOrder(
     orderFormId: String
       @deprecated(
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     reason: String
-  ): Boolean @withOrderFormId @withOwnerId
+  ): Boolean @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   updateItems(
     orderFormId: String
       @deprecated(
@@ -619,6 +666,7 @@ type Mutation {
       )
     items: [OrderFormItemInput]
   ): OrderForm
+    @auth(scope: PUBLIC)
     @withSegment
     @withOrderFormId
     @withOwnerId
@@ -638,7 +686,10 @@ type Mutation {
     Extra fields that can be added to the CL.
     """
     customFields: [ProfileCustomFieldInput]
-  ): Profile @withCurrentProfile @cacheControl(scope: PRIVATE)
+  ): Profile
+    @auth(scope: PUBLIC)
+    @withCurrentProfile
+    @cacheControl(scope: PRIVATE)
 
   """
   Updates one address related to a customer profile. This is the AD entity on MasterData.
@@ -653,13 +704,17 @@ type Mutation {
     Address's field.
     """
     fields: AddressInput
-  ): Profile @withCurrentProfile @cacheControl(scope: PRIVATE)
+  ): Profile
+    @auth(scope: PUBLIC)
+    @withCurrentProfile
+    @cacheControl(scope: PRIVATE)
 
   """
   Creates one address related to a customer profile. This is the AD entity on MasterData.
   The user needs to be signed in or impersonated to perform this mutation.
   """
   createAddress(fields: AddressInput): Profile
+    @auth(scope: PUBLIC)
     @withCurrentProfile
     @cacheControl(scope: PRIVATE)
     @deprecated(reason: "Prefer the saveAddress mutation instead.")
@@ -669,6 +724,7 @@ type Mutation {
   The user needs to be signed in or impersonated to perform this mutation.
   """
   saveAddress(address: AddressInput!): Address!
+    @auth(scope: PUBLIC)
     @withCurrentProfile
     @cacheControl(scope: PRIVATE)
 
@@ -681,7 +737,10 @@ type Mutation {
     Address's id.
     """
     id: String
-  ): Profile @withCurrentProfile @cacheControl(scope: PRIVATE)
+  ): Profile
+    @auth(scope: PUBLIC)
+    @withCurrentProfile
+    @cacheControl(scope: PRIVATE)
 
   """
   Updates the Profile Picture by erasing the old ones DEPRECATED
@@ -695,7 +754,11 @@ type Mutation {
     Attachment's field name (default: profilePicture)
     """
     field: String @deprecated
-  ): Profile @withCurrentProfile @deprecated @cacheControl(scope: PRIVATE)
+  ): Profile
+    @auth(scope: PUBLIC)
+    @withCurrentProfile
+    @deprecated
+    @cacheControl(scope: PRIVATE)
 
   """
   Uploads the Profile Picture by appending to the existing ones DEPRECATED
@@ -709,7 +772,11 @@ type Mutation {
     Attachment's field name (default: profilePicture)
     """
     field: String
-  ): Profile @withCurrentProfile @deprecated @cacheControl(scope: PRIVATE)
+  ): Profile
+    @auth(scope: PUBLIC)
+    @withCurrentProfile
+    @deprecated
+    @cacheControl(scope: PRIVATE)
 
   """
   Subscribe to newsletter
@@ -718,7 +785,7 @@ type Mutation {
     email: String
     isNewsletterOptIn: Boolean
     fields: NewsletterFieldsInput
-  ): Boolean @cacheControl(scope: PRIVATE)
+  ): Boolean @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Order Form
@@ -729,35 +796,35 @@ type Mutation {
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     fields: OrderFormProfileInput
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   updateOrderFormShipping(
     orderFormId: String
       @deprecated(
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     address: OrderFormAddressInput
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   updateOrderFormPayment(
     orderFormId: String
       @deprecated(
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     payments: [OrderFormPaymentInput]
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   updateOrderFormIgnoreProfile(
     orderFormId: String
       @deprecated(
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     ignoreProfileData: Boolean
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   addOrderFormPaymentToken(
     orderFormId: String
       @deprecated(
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     paymentToken: OrderFormPaymentTokenInput
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   setOrderFormCustomData(
     orderFormId: String
       @deprecated(
@@ -766,7 +833,7 @@ type Mutation {
     appId: String
     field: String
     value: String
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   addAssemblyOptions(
     orderFormId: String
       @deprecated(
@@ -775,24 +842,29 @@ type Mutation {
     itemId: String @coerce
     assemblyOptionsId: String
     options: [AssemblyOptionInput]
-  ): OrderForm @withOrderFormId @withOwnerId
+  ): OrderForm @auth(scope: PUBLIC) @withOrderFormId @withOwnerId
   updateOrderFormCheckin(
     orderFormId: String
       @deprecated(
         reason: "Field is no longer needed. Checkout cookie is automatically taken into account now"
       )
     checkin: OrderFormCheckinInput
-  ): OrderForm @withOrderFormId @withOwnerId @cacheControl(scope: PRIVATE)
+  ): OrderForm
+    @auth(scope: PUBLIC)
+    @withOrderFormId
+    @withOwnerId
+    @cacheControl(scope: PRIVATE)
 
   """
   Payment
   """
-  createPaymentSession: PaymentSession
+  createPaymentSession: PaymentSession @auth(scope: PUBLIC)
   createPaymentTokens(
     sessionId: String
     payments: [PaymentInput]
-  ): [PaymentToken]
+  ): [PaymentToken] @auth(scope: PUBLIC)
   setPlaceholder(fields: PlaceholderInput): Boolean
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
 
   """
@@ -803,7 +875,7 @@ type Mutation {
     User email
     """
     email: String!
-  ): Boolean @cacheControl(scope: PRIVATE)
+  ): Boolean @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Access key sign in mode
@@ -817,7 +889,7 @@ type Mutation {
     Access key that was received
     """
     code: String!
-  ): String @cacheControl(scope: PRIVATE)
+  ): String @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Classic sign in mode
@@ -831,7 +903,7 @@ type Mutation {
     User password
     """
     password: String!
-  ): String @cacheControl(scope: PRIVATE)
+  ): String @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   OAuth to login with Social Account
@@ -845,7 +917,7 @@ type Mutation {
     The URL to be redirected after authentication
     """
     redirectUrl: String
-  ): String @cacheControl(scope: PRIVATE)
+  ): String @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   To recovery password you need to get your email, password and access code
@@ -863,7 +935,7 @@ type Mutation {
     Access Code
     """
     code: String!
-  ): String @cacheControl(scope: PRIVATE)
+  ): String @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Change password using email and old password
@@ -885,12 +957,13 @@ type Mutation {
     Your app's identification to help VTEX ID track requests
     """
     vtexIdVersion: String
-  ): String @cacheControl(scope: PRIVATE)
+  ): String @auth(scope: PUBLIC) @cacheControl(scope: PRIVATE)
 
   """
   Invalidate VtexIdclientAutCookie
   """
   logout: Boolean
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
     @deprecated(
       reason: "See https://github.com/vtex-apps/store-graphql/issues/182"
@@ -899,7 +972,9 @@ type Mutation {
   """
   Logs out from a specific login session
   """
-  logOutFromSession(sessionId: ID): ID @cacheControl(scope: PRIVATE)
+  logOutFromSession(sessionId: ID): ID
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
 
   """
   Impersonate a customer
@@ -909,12 +984,17 @@ type Mutation {
     The email which will be used to impersonate a user
     """
     email: String!
-  ): Session @withOrderFormId @withOwnerId @cacheControl(scope: PRIVATE)
+  ): Session
+    @auth(scope: PUBLIC)
+    @withOrderFormId
+    @withOwnerId
+    @cacheControl(scope: PRIVATE)
 
   """
   Depersonify a customer
   """
   depersonify: Boolean
+    @auth(scope: PUBLIC)
     @withOrderFormId
     @withOwnerId
     @withSegment
@@ -928,32 +1008,37 @@ type Mutation {
     document: DocumentInput
     account: String
     schema: String
-  ): DocumentResponse @withAuthMetrics
+  ): DocumentResponse @auth(scope: PUBLIC) @withAuthMetrics
   updateDocument(
     acronym: String!
     document: DocumentInput
     account: String
     schema: String
-  ): DocumentResponse @withAuthMetrics
+  ): DocumentResponse @auth(scope: PUBLIC) @withAuthMetrics
   deleteDocument(acronym: String!, documentId: String!): DocumentResponse
+    @auth(scope: PUBLIC)
     @withAuthMetrics
   uploadAttachment(
     acronym: String!
     documentId: String!
     field: String!
     file: Upload!
-  ): AttachmentResponse @withAuthMetrics
+  ): AttachmentResponse @auth(scope: PUBLIC) @withAuthMetrics
   createDocumentV2(
     dataEntity: String!
     document: DocumentInputV2
     account: String
     schema: String
-  ): DocumentResponseV2 @cacheControl(scope: PRIVATE) @withAuthMetrics
+  ): DocumentResponseV2
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
+    @withAuthMetrics
 
   """
   List
   """
   createList(list: ListInput): List
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
     @withAuthMetrics
   """
@@ -963,17 +1048,23 @@ type Mutation {
   Otherwise, update it.
   """
   updateList(id: ID!, list: ListInput): List
+    @auth(scope: PUBLIC)
+    @cacheControl(scope: PRIVATE)
+    @withAuthMetrics
+  deleteList(id: ID!): List
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
     @withAuthMetrics
-  deleteList(id: ID!): List @cacheControl(scope: PRIVATE) @withAuthMetrics
 
   savePickupInSession(address: OrderFormAddressInput, name: String): Session
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
 
   """
   Set new orderForm.
   """
   newOrderForm(orderFormId: String): OrderForm
+    @auth(scope: PUBLIC)
     @cacheControl(scope: PRIVATE)
     @withOrderFormId
     @withOwnerId
diff --git a/manifest.json b/manifest.json
index 07129fc6..84851449 100644
--- a/manifest.json
+++ b/manifest.json
@@ -6,7 +6,7 @@
   "description": "GraphQL schema and resolvers for the VTEX API for the catalog and orders.",
   "credentialType": "absolute",
   "builders": {
-    "graphql": "1.x",
+    "graphql": "2.x",
     "node": "7.x",
     "docs": "0.x"
   },