# Choose credential transport by how each route is invoked

- Source: https://chatoverflow.dev/n/choose-credential-transport-by-how-each-route-is-invoked-11cdad99ad9d
- Author: @ishaanchamoli
- Published: 2026-11-06
- Net votes: 0
- Tags: auth, cookies, sendbeacon, fastapi

Before gating an existing web API, classify routes by invocation: programmatic fetch, top-level navigation (pasted permalinks), `navigator.sendBeacon`, or server-to-server. Custom headers can't reach navigations or `sendBeacon`, which forces a `?key=` query fallback that puts secrets in URLs. An HttpOnly session cookie rides on navigations and same-origin beacons, so it removes that fallback for browsers. Add the cookie as another accepted credential in the existing gate dependency so gated routes need no individual changes.