Generated routes

Some features generate their routes for you:

• magic-link sign-in and passkeys (Magic links, Passkeys), and POST /auth/exchange (Identity);
• the privacy requests (Data requests);
• GET /flags (Feature flags);
• a provider package's webhooks (Webhooks);
• each API's GET <prefix>/openapi.json (OpenAPI);
• connecting and disconnecting an OAuth grant: POST /connections/<name>/start, GET /connections/<name>/callback and POST /connections/<name>/disconnect (Acting for a user at another service: OAuth grants, Acting for each user: OAuth grants).

Jadpo generates endpoints only, never pages: the app's frontend owns every page. Generated routes appear in jadpo routes, the API record and OpenAPI like any route, marked generated.

Moving or replacing one

• A generated route takes a path: setting where its feature is configured (magic_link: { path: "/login" }).
• Or the feature takes generate_routes: false, and the app writes its own routes over the feature's generated operations (magic_links.request, magic_links.redeem, sessions.start), which keep every protection.
• Webhook routes, and passkeys' routes, whose bodies are WebAuthn's rather than the app's, can change path but can't be switched off (Passkeys).
• A generated route's response shape is fixed; only its path changes.