A URL that runs code
Your AI added a 'Delete my account' button, plus a file called app/api/delete-account/route.ts. You wonder who else can reach that address.
This answers: What is an API route? No coding needed. 3 quick decisions.
- Reading code
- How a request travels
- Who may see what
Step 1 of 3
Who can call this route?
export async function POST(req: Request) { const { userId } = await req.json(); await db.user.delete({ where: { id: userId } }); return Response.json({ ok: true });}What is an API route?
An is a URL on your site that runs server code instead of showing a page, like /api/delete-account. Anyone on the internet can send it a request, not just your button. So every route must check who is signed in, using their session, and never trust a user id sent in the request.
Breaks at Your server: Deletes whichever id it's sent
Why AI tools write this bug
AI tools often pass the user's id from the browser to the route because it's simple, and the route trusts it without checking the session.
How to fix it
- List every route under app/api and every server action.
- Check each one requires a signed-in user.
- Take the user from the session, not the request body.
- Check they're allowed to touch the record they ask for.
Check your own app
Paste this into Lovable, Cursor or Claude Code:
Without changing anything, list every API route and server action in this project. For each, tell me what it does, whether it checks that someone is signed in, and whether any user id, team id or price it acts on comes from the request instead of the session or the database.
Common questions
- Is a server action different from an API route?
- It's written differently, but it's still a public endpoint that anyone can call. It needs the same sign-in and permission checks.