For anyone else looking at this...My issue was that I wasn't creating a GraphQLClient at all. I was just using the exported request function from graphql-request. Once I created a client and specified credentials: 'include' the cookies were automatically set and sent from and to the server.