property RouteSchema.security
Since 0.2.0

OpenAPI security requirements for this operation, overriding any document-level default. Each entry names a scheme declared in the document's components.securitySchemes and lists the scopes it needs (empty for non-OAuth2 schemes such as HTTP bearer or API key).

An empty array is meaningful and is NOT the same as omitting the field: per the OpenAPI specification it declares the operation public, which is how a route opts out of a document-level requirement. Omitting the field leaves the operation inheriting whatever the document declares.

Declaring this does not enforce anything — authentication is enforced by middleware and guards. This describes the route for documentation and client generation.

Declaring is not the only way a document learns about authentication: a requirement can instead be DERIVED from guards branded with RouteSecurityMetadata, which is what @setu-ts/auth-plugin's guards carry. A value declared here always wins over a derived one.

Examples

Example 1

// Requires the `bearerAuth` scheme:
app.router.get('/todos/:id', {
  schema: { security: [{ bearerAuth: [] }] },
  handler,
});

// Explicitly public, even when the document requires auth by default:
app.router.post('/login', { schema: { security: [] }, handler });

Type

Usage

import { type RouteSchema } from "common/src/index.ts";