Public endpoints

A restricted web app can keep a webhook, callback, or public API route open without exposing the rest of the Service. Public paths bypass Tokay Access only for the URLs you choose.

Last updated August 10, 2026

AI agent? Start with llms.txt.

You can add a public path from the Project's Access tab by finding the web app under Services and choosing Edit access.

Open the smallest useful path

A public path can match one exact URL or one subtree.

• /webhooks/stripe matches that path with or without a trailing slash.
• /api/public/* matches paths below /api/public/, but not /api/public itself.

A wildcard can appear only at the end of a path. To expose every path, use Make public for the whole Service. Tokay rejects /* because whole Service access has its own setting.

Public requests skip Tokay sign in

Anyone who knows a public path can call it. When the sender provides a verification method, your code should still use it to confirm who sent the request.

For webhooks, verify signatures from Stripe, GitHub, or the service sending the request. An exact path is usually the clearest choice when one endpoint is enough.

Functions use whole Service access

Public paths apply only to web apps. When an outside provider needs to call a function anonymously, make the function Public and verify the request in your code.

A function used only by systems you control can stay Restricted. Each caller can use a Machine identity and credential so Tokay can authenticate and identify its requests.