1
Send
The client is the same everywhere — it is
fetch and a key, with no Node-only dependency in the call path.2
Protect routes
lathExpress verifies the bearer token and puts the user on req.lath. A request without a valid one is answered 401 with www-authenticate: Bearer and the usual { error: { code, message, fix } } body — the middleware never hands a half-authenticated request to your handler.3
Without a framework
userFromNodeRequest takes a raw Node request and returns the user or null, which is everything Fastify, Koa or node:http needs.
