# Generated routes

Some features generate their routes for you:

- magic-link sign-in and passkeys ([Magic links](/docs/magic-links.md),
  [Passkeys](/docs/passkeys.md)), each sign-in provider's
  `POST /auth/<name>/start` and `GET /auth/<name>/callback`
  ([Providers](/docs/checking-the-person-sign-in.md#providers)), and `POST /auth/exchange`
  ([Sign-in and identity](/docs/identity.md));
- the privacy requests ([Data requests](/docs/data-requests.md));
- each API's `GET <prefix>/flags`, while a flag has `client: true`
  ([Flags in browsers and apps](/docs/feature-flags.md#flags-in-browsers-and-apps));
- a provider package's webhooks ([Webhooks](/docs/webhooks.md));
- each API's `GET <prefix>/openapi.json` ([OpenAPI](/docs/openapi.md));
- `<path>/confirmation` beside a route with `confirm:
  Confirmation.passkey`, asked with the route's method, with the options
  for confirming its request
  ([Confirm one request with a passkey](/docs/routes-signed-in-by-default.md#confirm-one-request-with-a-passkey-confirm-confirmationpasskey));
- connecting and disconnecting an OAuth grant:
  `POST /connections/<name>/start`, `GET /connections/<name>/callback` and
  `POST /connections/<name>/disconnect`
  ([OAuth grants](/docs/oauth-grants.md)).

Jadpo generates endpoints only, never pages: the app's frontend owns every
page. Generated routes appear in `jadpo routes`, the API record and OpenAPI
like any route, marked generated.

## Moving or replacing one

- A generated route takes a `path:` setting where its feature is
  configured (`magic_link: { path: "/login" }`).
- Or the feature takes `generate_routes: false`, and the app writes its own
  routes over the feature's generated operations (`magic_links.request`,
  `magic_links.redeem`, `sessions.start`), which keep every protection.
- Webhook routes, and passkeys' routes, whose bodies are WebAuthn's rather
  than the app's, can change path but can't be switched off
  ([Passkeys](/docs/passkeys.md)).
- A generated route's response shape is fixed; only its path changes.