IMO it should be a mutation, simply because it's more logical. You may not necessarily edit data in the DB right now, but you do generate a token at least which makes it already different from a simple query. Later, you may find yourself that tokens are not secure enough so you save the session token in your DB which makes it a mutation.