Generated routes

Some features generate their routes for you:

• magic-link sign-in and passkeys (Magic links, Passkeys), each sign-in provider's POST /auth/<name>/start and GET /auth/<name>/callback (Providers), and POST /auth/exchange (Sign-in and identity);
• the privacy requests (Data requests);
• each API's GET <prefix>/flags, while a flag has client: true (Flags in browsers and apps);
• a provider package's webhooks (Webhooks);
• each API's GET <prefix>/openapi.json (OpenAPI);
• <path>/confirmation beside a route with confirm: Confirmation.passkey, asked with the route's method, with the options for confirming its request (Confirm one request with a passkey);
• connecting and disconnecting an OAuth grant: POST /connections/<name>/start, GET /connections/<name>/callback and POST /connections/<name>/disconnect (OAuth grants).

Jadpo generates endpoints only, never pages: the app's frontend owns every page. Generated routes appear in jadpo routes, the API record and OpenAPI like any route, marked generated.

Moving or replacing one

• A generated route takes a path: setting where its feature is configured (magic_link: { path: "/login" }).
• Or the feature takes generate_routes: false, and the app writes its own routes over the feature's generated operations (magic_links.request, magic_links.redeem, sessions.start), which keep every protection.
• Webhook routes, and passkeys' routes, whose bodies are WebAuthn's rather than the app's, can change path but can't be switched off (Passkeys).
• A generated route's response shape is fixed; only its path changes.