# `Sake.Router`
[🔗](https://github.com/hattoriai/sake/blob/v0.4.3/lib/sake/router.ex#L2)

Router macros for Phoenix hosts:

    import Sake.Router

    scope "/" do
      sake_well_known()
    end

    scope "/oauth" do
      pipe_through :api
      sake_oauth_api()
    end

    scope "/oauth" do
      pipe_through [:browser, :require_authenticated_user]
      sake_oauth_authorize()
    end

    scope "/:org_slug" do
      sake_endpoint "/mcp", server: MyApp.MCP, auth: true
    end

The authorize routes (with the device verification page, for
`device:`) go inside the pipeline that requires a signed-in person;
the API routes (the pushed authorization request endpoint among them,
for `par:`, and the JWKS and userinfo endpoints, for `openid:`) need
no session; the well-known routes need no
pipeline at all; the endpoint needs no pipeline either (Sake checks the
bearer token itself).

An endpoint whose tokens come from another authorization server names
its `external_auth:` configuration (see `Sake.Auth.External`), and
needs only the well-known routes, for its protected resource metadata:

    scope "/" do
      sake_well_known()
      sake_endpoint "/partners/mcp", server: MyApp.MCP, auth: :keycloak
    end

# `sake_endpoint`
*macro* 

Mounts a Sake endpoint at `path` with the `Sake.Plug` options; works under a scope with a dynamic segment.

# `sake_oauth_api`
*macro* 

# `sake_oauth_authorize`
*macro* 

# `sake_well_known`
*macro* 

---

*Consult [api-reference.md](api-reference.md) for complete listing*