TanStack Start Authentication

Define the trust boundary

Read ../../docs/authentication-and-security.md. Identify the principal, credential, session store, protected resource, tenant boundary, and every callable endpoint.

Protect the data endpoint

Authenticate and authorize inside every server function or server route that accesses protected data. Use beforeLoad only for navigation behavior and early UX.

Implement secure primitives