Configuration Overview

HTTP Guardian configuration is read layer by layer. Each layer has a distinct responsibility.

Layer	File or object	Responsibility
Client	HttpClientOptions	Describes the target API and default behaviors.
Request	RequestOptions	Describes what changes for one specific call.
Auth	AuthConfig	Produces credentials at request time.
Parser	ApiParser	Converts the raw response into ClientResult<T>.
Guards	HttpGuard[]	Composes behaviors around the transport.
Plugins	HttpPlugin[]	Applies cross-cutting policies when the client is created.

Integration Checklist

1. Provide a baseUrl that points to the API root, not to a final endpoint.
2. Declare auth, even with noAuth().
3. Choose a parser that matches the backend's real envelope.
4. Define non-sensitive global headers in defaults.headers.
5. Put default timeouts and notifications at the client level.
6. Enable cache only on idempotent reads.
7. Add refresh, CSRF, and idempotency with documented exclusions.

Sound decision

When an option changes based on the user, route, or button, it often belongs to RequestOptions. When it changes based on the backend, it belongs to the client.