API
Authentication template
Decide and document how your product API authenticates callers
The boilerplate authenticates its web application with Better Auth sessions. It does not include API-key issuance, bearer-token authentication or a dashboard for rotating keys.
If your product needs machine-to-machine access, implement the credential lifecycle, scoped authorization, revocation, audit logging and rate limiting first. Replace this page with the tested contract only after that work exists.