Security & Caching

Applies to: v3

Security & Caching

Authentication

• Default: routes require a valid JWT (Authorization: Bearer ...).
• Public routes: a small set is allowed without JWT but requires x-api-key matching env.API_KEY.
• Middleware: src/middleware/auth.ts detects public patterns with regex and otherwise applies RS256 JWT verification using env.JWT_PUBLIC_KEY.

Public (API-key) routes include:

• /v3/users/:device_id (GET) — login/create user

Caching

• conditionalCache middleware is applied to selected GET routes to enable CDN caching where safe.
• Note: The scan endpoint currently uses conditionalCache; confirm cache behavior if user-specific responses are returned.

Headers

• Public route access: x-api-key: <env.API_KEY>
• Authenticated route access: Authorization: Bearer <JWT>