Documentation

Server contract

How backend calls inject tenant state, auth cookies, and fallback credentials.

The server contract is implemented in src/lib/server/zship-proxy.ts.

Request shaping

JSON request bodies receive app_key from APP_KEY by default.
Authenticated route handlers read the HttpOnly auth cookie and forward it as Authorization: Bearer ....
Client IP and user agent are forwarded to backend services when available.
Public read routes such as blog can opt out of body injection where query params already carry app_key.

Binding first

If a Cloudflare Service Binding is present, the proxy uses binding.fetch(new Request(...)). Service Binding calls do not attach x-zship-key.

HTTP fallback

When no binding is available, the proxy uses configured fallback URLs or local defaults. Only this path may attach x-zship-key from ZSHIP_KEY.

Auth cookies use zship_auth_${appKey}, are HttpOnly, use SameSite=Lax, and are marked Secure for HTTPS requests.