Bootstrap an Authenticated App

/bootstrap is a recommended app design pattern: an endpoint you implement in a Site Members Function to return safe startup information. It is not a required MiniUp route, login endpoint, internal MiniUp API, automatic authorization, or special runtime syntax.

Implement a bootstrap endpoint

1. Create a Site Members Function linked to your Site.
2. Add a GET handler for a path ending in /bootstrap.
3. Read the member from env.MINIUP_USER and return safe identity and feature flags.
4. Test and publish the Function.
5. Call the endpoint from the linked Site and use the result to initialize the UI.

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    if (request.method === "GET" && url.pathname.endsWith("/bootstrap")) {
      const user = env.MINIUP_USER;
      if (!user) return Response.json({ error: "Sign in required" }, { status: 401 });
      return Response.json({
        user: { id: user.id, name: user.name, role: user.role },
        features: {
          dashboard: true,
          reports: user.role !== "viewer",
          administration: user.role === "owner" || user.role === "admin"
        }
      });
    }
    return Response.json({ error: "Not found" }, { status: 404 });
  }
};

The example returns a subset of identity fields to avoid exposing unnecessary email information. An app may return more user-safe fields when needed.

Load the frontend from bootstrap data

const status = document.querySelector("#status");
try {
  status.textContent = "Loading your app…";
  const response = await fetch("/api/functions/my-app-api/bootstrap");
  if (!response.ok) throw new Error(`Unable to load app (${response.status})`);
  const app = await response.json();
  if (app.features.dashboard) {
    const dashboard = await import("./components/dashboard.js");
    dashboard.render(app);
  }
  status.textContent = "";
} catch (error) {
  status.textContent = error.message;
}

Create the referenced component file with an exported render function. The complete example includes the frontend files and a backend permission check.

Choose safe bootstrap contents

Typical contents include user-safe identity, role, feature availability, navigation flags, and browser-safe application configuration. Never include API keys, Function Secrets, private credentials, or data the member is not authorized to receive.

Enforce authorization after bootstrap

A bootstrap response helps the UI decide what to show. It does not authorize later requests. Each backend operation must check current trusted permissions again. Importing admin.js only for Admins does not secure the API that admin.js calls.

Related guides

• Use env.MINIUP_USER
• Frontend versus backend authorization
• Function Secrets
• Complete member dashboard