Browser sessions

Choose between direct application-user bearer tokens and a same-origin backend-for-frontend that keeps refresh credentials in HttpOnly cookies.

Direct SPA

const response = await fetch(`${TRESTLE_URL}/api/v1/collections/issues/records`, {
  headers: {Authorization: `Bearer ${accessToken}`}
});

Keep short-lived access tokens in memory where practical. Browser storage is vulnerable to successful script injection, so avoid long-lived service or refresh credentials in localStorage.

Backend-for-frontend

This pattern gives the browser a same-origin session while the server owns refresh rotation and credential storage. Apply CSRF protections to cookie-authenticated mutations.

Realtime

Native EventSource cannot set an Authorization header. A same-origin SSE proxy or cookie-based application boundary is usually cleaner than putting bearer credentials in query strings.