API overview

Hono Worker at your API origin. JSON in / JSON out. Public routes for the widget and portal; session-protected routes for the dashboard.

Base URL

CORS

Controlled by Worker var ALLOWED_ORIGINS (comma-separated). Supports exact origins and *.openroadmap.app-style host suffixes. Credentialed requests allowed for dashboard session headers.

Auth

• Public — no auth (widget + portal reads + votes)
• Session — header X-OpenRoadmap-Session: <token> or Authorization: Bearer <token> from POST /v1/auth/login

Errors

{ "error": "Domain not allowed for this project" }