TanStack API Routes

TanStack Start server handlers are used for web-owned endpoints such as metadata, feeds and the future external gateway adapters. Product data itself lives behind the Forms API, while shared platform data lives behind Core.

Route pattern

import { createFileRoute } from "@tanstack/react-router";
import { z } from "zod";

const querySchema = z.object({ cursor: z.string().optional() });

export const Route = createFileRoute("/api/example")({
  server: {
    handlers: {
      GET: async ({ request }) => {
        const input = querySchema.parse(
          Object.fromEntries(new URL(request.url).searchParams),
        );
        return Response.json({ input });
      },
    },
  },
});

Service calls

• Interactive Core calls use an Identity access token with Core as audience.
• Product API calls use the short-lived Core-signed product session.
• External API/MCP calls will use a gateway context derived from a Core API key or OAuth token.

Never import a service database client into a TanStack route and never forward a token to a different audience.

Errors

Public handlers return a stable machine key, an HTTP status and no internal stack trace. Unavailable planned surfaces return 501, not fake success data.