Authentication

Auth helpers avoid manual headers. The token or key is read at request time, which lets the application store remain the source of truth.

bearerAuth(getToken, opts)

Adds a Bearer token when getToken returns a non-empty value. getToken can be synchronous or asynchronous.

auth: bearerAuth(() => tokenStore.access(), {
  allowedOrigins: ["https://api.example.com"]
})

Option	Default	Meaning
headerName	Authorization	Name of the sent header.
prefix	Bearer	Prefix placed before the token.
allowedOrigins	Same origin as baseUrl	Limits token sending to allowed origins.

Do not read the token once when the client is created. Provide a function that reads the current value again.

cookieAuth(opts)

Mode suited to browser sessions backed by cookies.

auth: cookieAuth({ credentials: "include" })

credentials: "include" is required for cross-site cookies. The backend must then configure CORS, SameSite=None, and Secure correctly.

basicAuth(getCredentials, opts)

Encodes a username/password pair or a prebuilt user:pass string. Reserve it for internal tools, technical endpoints, or legacy compatibility under TLS.

apiKeyAuth(getKey, opts)

Adds an API key in a configurable header, X-API-Key by default.

Never expose a privileged key in a public browser. Route through a backend when the key is secret.

noAuth()

Explicitly declares no authentication.

const publicApi = createHttpClient({
  baseUrl: "https://status.example.com",
  auth: noAuth(),
  parser
});

Use noAuth() for login, refresh, health, public assets, and demo clients.