Public routes

A Private web Service can keep one path open for a webhook, callback, or public API without opening the rest of the Service. Each public route names HTTP methods and a path that open without sign in.

Last updated

AI agent? Start with llms.txt.

Add one under Public routes on the Service Access tab with Add a public route. A public route widens who can reach the Service, so Tokay asks you to confirm it first. Removing one takes effect without a confirmation.

Open the smallest useful request

  • POST /webhooks/stripe matches that exact method and path.
  • GET /assets/* matches descendants below /assets/ and also covers HEAD.
  • A prefix does not match its unslashed root. Add exact /assets when both should be public.

A wildcard can appear only as trailing /*. Tokay rejects /* because whole Service Public access is the clearer choice. Ambiguous encodings, matrix parameters, and Tokay reserved paths are rejected before matching.

Protect the Service first

Public routes matter only while the Service is Private. You can add them while it is Public. They stay stored and take effect when the Service returns to Private. A Public Service cannot require sign in on one path.

SPA client routes are not security boundaries. Protect the API paths that return data or perform actions.

Public routes are always anonymous

Every matching request is anonymous. Tokay strips browser, OAuth, and Machine credentials before proxying.

Your code must still verify provider signatures or application authentication when the sender supplies them.

Functions use whole Service access

Functions have no public routes. Choose Public for an anonymous provider, or keep the function Private and add each controlled Machine directly or through a Group.