# HTTP (/docs/reference/http)

```ts
import { … } from "@monarcode/session-kit/http";
```

Guide: [Authenticated requests](/docs/client/requests).

## Functions [#functions]

### createAuthFetch [#createauthfetch]

Creates a `fetch` for your API ([`AuthFetch`](#authfetch)) that sends the current access token as `Authorization: Bearer`. After a 401, it gets a new access token once. `GET` and `HEAD` requests are then sent again; other requests resolve the 401 for you to retry. If the request sent again gets a 401 too, the user is signed out, unless `signOutOnRepeated401` is off.

## Types [#types]

### AuthFetch [#authfetch]

The `fetch` that [`createAuthFetch`](#createauthfetch) returns. Call it with a path under your API's base URL, and `init` as you would pass to `fetch`. Use the name to type a prop, a context or a test fake that stands in for it.

### AuthFetchClient [#authfetchclient]

The part of an auth client that [`createAuthFetch`](#createauthfetch) uses. A `createAuth` or `createMirrorAuth` client fits, and so does a request's session from `serverAuth.forRequest(jar)`.

### AuthFetchOptions [#authfetchoptions]

Options for [`createAuthFetch`](#createauthfetch).

### AuthFetchOptions

Options for createAuthFetch.

| Prop                    | Type    | Description                                                                                                                                                                                                                                                                                                                      |
| ----------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `optional?`             | `union` | Whether a request made while signed out is sent without an `Authorization` header, rather than rejecting with `UNAUTHENTICATED`. Set `true` when one `authFetch` serves public and private endpoints. A locked client still rejects with `LOCKED`. A 401 to a request sent without a token comes back as it is. Default: `false` |
| `signOutOnRepeated401?` | `union` | Whether a second 401, after a successful refresh, signs the user out. Set `false` when some endpoints answer 401 for reasons other than a rejected token, so they can't sign users out. Default: `true`                                                                                                                          |