Skip to main content
EdgeSpark enforces authentication through URL path conventions. There is no auth middleware for you to register. The route prefix determines the behavior.

The three path conventions

Protected routes

server/src/index.ts

Public routes

server/src/index.ts

Webhook routes

server/src/index.ts
Webhook routes have no platform-level session authentication. Always verify signatures or shared secrets from the sender. See Authenticate users for a full verification example.

See also

Authenticate users

How to read the current user and verify incoming webhooks.

auth reference

The runtime auth API and when auth.user is available.
Last modified on April 7, 2026