# HTTP (https://session-kit.pages.dev/docs/reference/http)

```ts
import { … } from "@monarcode/session-kit/http";
```

Guide: [Authenticated requests](https://session-kit.pages.dev/docs/client/requests).

## Functions

### createAuthFetch

Creates a `fetch` for your API ([`AuthFetch`](#authfetch)) that sends the current access token as `Authorization: Bearer`. After a 401, it gets a new access token once. `GET` and `HEAD` requests are then sent again; other requests resolve the 401 for you to retry. If the request sent again gets a 401 too, the user is signed out, unless `signOutOnRepeated401` is off.

## Types

### AuthFetch

The `fetch` that [`createAuthFetch`](#createauthfetch) returns. Call it with a path under your API's base URL, and `init` as you would pass to `fetch`. It takes a `URL` or a `Request` too, as `fetch` does.

### AuthFetchClient

The part of an auth client that [`createAuthFetch`](#createauthfetch) uses. A `createAuth` or `createMirrorAuth` client fits, and so does a request's session on the server (`RequestAuth`).

### AuthFetchOptions

Options for [`createAuthFetch`](#createauthfetch).

### AuthFetchOptions

Options for createAuthFetch.

| Prop                    | Type     | Description                                                                                                                                                                                                                                                                                                                      |
| ----------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `baseUrl`               | `string` | Your API's base URL. It must be absolute, such as `https://api.example.com/`. The access token goes only to requests on its origin. A path is resolved against it as a link is against a page's address. End it with `/`, so that `"orders"` lands under it.                                                                     |
| `optional?`             | `union`  | Whether a request made while signed out is sent without an `Authorization` header, rather than rejecting with `UNAUTHENTICATED`. Set `true` when one `authFetch` serves public and private endpoints. A locked client still rejects with `LOCKED`. A 401 to a request sent without a token comes back as it is. Default: `false` |
| `signOutOnRepeated401?` | `union`  | Whether a second 401, after a successful refresh, signs the user out. Set `false` when some endpoints answer 401 for reasons other than a rejected token, so a second 401 from them doesn't sign users out. Without a refresh token or a `refresh` option, the first 401 still does. Default: `true`                             |