HTTP routes

Read this as a table of two columns

The strategy column is verification strategies, the scopes are dashboard scopes, refusals carry an error code, and what mounts them is the Worker contract.

A path, and the strategy that guards it. There is no implicit authentication anywhere in the kit, so every row below names one of five:

bearer and session are one guard in practice — requireAuth() accepts either, and the rows below say user where that guard runs. What separates them is the client, not the route.

Every base path is yours to move

The prefixes below are defaults. Each is a config key, and moving one moves every route under it.

Auth

That last row is most of what a sign-in flow actually calls. Sign-in, sign-out, the OAuth callback, verification, /token, /jwks and session listing are Better Auth’s endpoints, mounted under the same prefix and answering in Better Auth’s own response shape — deliberately, because createAuthClient is a documented client surface and re-homing the body would strand every adopter reading error.code.

The admin routes are registered before the catch-all, or they would be dead: /auth/admin/users would reach Better Auth, which knows no such endpoint, and the 404 would come from the wrong layer entirely.

When Turnstile is composed, the magic-link and OTP send routes wear the humanity check automatically. You do not wire that.

Payments

A grant is a control-plane call, not an admin user’s click. Comping somebody a year of Pro leaves a row signed by an issued credential with a scope on it, which is a different kind of record from a session that happened to belong to staff.

Storage

GET /storage/:id carries no requireAuth, on purpose: a public object has to be readable without a session, so authorization moves into the handler where it can see whether this object is public. The HEAD beside it does require a session — a metadata probe is not a download.

Media

Email

There is no end-user surface in the management file at all. A recipient interacts with email by receiving it; the three routes a recipient calls are the public callbacks, and each is gated by the signature on the token in its path.

Removing a suppression is a POST with a body, not DELETE /suppressions/:address. An address in a path is an address in every access log, proxy, trace and referrer between the client and the Worker.

Vector

Secrets

Status, and never value. Nothing on this surface returns a secret; it returns whether one exists, when it was last rotated, and what happened on each rotation.

Audit

Reads only. The trail is append-only, and this surface has no write route to omit — there is nothing to leave out, because there is nothing there.

Support

Testers

Opting out answers both verbs. A one-click unsubscribe header sends a POST; a person clicking the same link in a mail client sends a GET. Refusing either would refuse somebody trying to leave.

Ledger

The two write routes stack a second guard on the first. A session alone reaches the balance; moving a balance also requires the configured admin scope on the caller. A user who could credit themselves is not a ledger.

Games

Leaderboard

Rating

Multiplayer

Matchmaking

serverAuthoritative is the switch worth understanding before you ship a game. With it on, a score or an outcome is only accepted from a caller carrying the configured scope — which means from your own server, not from a client somebody can open in a debugger.

The control plane, and the kit’s own paths

/health is public because a health check that needs a credential is a health check nothing runs.

Two things this list implies

Your asset allowlist is derived from this table. run_worker_first has to name the paths the Worker owns, and every path above is one — which is why the CLI computes the list rather than asking you to keep one by hand.

A capability you have not composed mounts nothing. These are not reserved paths waiting to be claimed. Remove the capability and its prefix is free.