Protected functions

Requiring Flares Auth: verified users in $request->user(), free 401s.

Two access modes

Mode	Who may invoke
Public	Anyone with the URL. Your code decides everything.
Requires Flares Auth	Only callers with a valid, live access token from this project's Auth. Verified before your code runs.

Set it when creating the function, or later on its Overview screen.

Calling a protected function

await fetch(`https://cloud.flaresinc.com/run/${PROJECT}/create-shipment`, {
  method: 'POST',
  headers: {
    'X-Flares-User-Token': session.access_token,   // or: Authorization: Bearer …
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ destination: 'Kano' })
});

The verified user in your handler

return function (Request $request): Response {
    $user = $request->user();          // never null in auth mode

    return Response::json([
        'created_by' => $user['id'],           // usr_…
        'email'      => $user['email'],
        'verified'   => $user['email_verified'],
        'claims'     => $user['claims'],
    ], 201);
};

The gateway verified the token, checked the user still exists and is active, and passed the result in. Nothing inside the sandbox can forge it — the token itself never reaches your code.

Refused requests are free. A missing, expired, revoked or foreign-project token is rejected before dispatch: 401, no execution, and no billable request. Protecting an endpoint also protects your bill from unauthenticated traffic.

Disabled users

Disabling a user or revoking their sessions stops their token resolving immediately — the next invocation is a 401. There is no cache to wait out. Sessions and revocation →