Routes: signed in by default

Every route needs a signed-in caller unless it says otherwise. You don't write anything for that. A request without a valid session or token is refused with a 401 before your code runs.

A route changes this with an authentication: line, which takes one of two values.

Open to anyone: RouteAuthentication.none

Use it for routes people call before they have an account, such as a health check or a sign-up form.

GET /health/live {    authentication: RouteAuthentication.none    output: Health    run: live()}

The route doesn't look for a session or token, so it never knows who is calling. The compiler stops anything the route runs from reading the caller (type.auth_public_principal).

Only the sign-in check is skipped. Input is still validated and limits still count. Policy still decides whether the route's action may run for someone who isn't signed in. A route can be open to anyone and still be refused by policy.

Check the caller again: RouteAuthentication.fresh

Use it where acting for someone who was signed out a moment ago would do harm, such as disabling an account, changing permissions, billing or exports.

DELETE /users/{user_id} {    authentication: RouteAuthentication.fresh    run: disable_user(user_id, current_principal.user)}

fresh only changes anything if your app sets a revocation_delay. By default, Jadpo looks up the caller's record on every request, so a session you revoke stops working at once. With a delay, for example revocation_delay: 5m, sessions are trusted for up to five minutes without that lookup, so a disabled user may keep working until then (see The application and revocation). A fresh route always does the lookup, whatever the delay.

Any other value

Anything else is a compile error. The error offers both fixes rather than guessing, because one keeps the route protected and the other opens it to anyone.

Apps with more than one API

An app can serve several APIs, for example main for its own clients and partners for other companies' servers, each under its own path prefix (APIs). Each API lists the ways a caller may prove who they are, and every route in it accepts those:

// app.jadpoapis: {    main: {        prefix: /        authentication: [AuthenticationMethod.browser_session, AuthenticationMethod.api_token]    }    partners: {        prefix: /partners        authentication: [AuthenticationMethod.service_key]    }}

Here a browser session or an API token works on any route under /, and only a service key works under /partners. A route can narrow its API's list but never add to it. An app with a single API accepts every method.

Webhooks from a provider such as Stripe aren't routes you write, so there's nothing here to set. Jadpo generates them, checks each one's signature and passes it to your app as an event (Integrations).