Express routes

npx shadcn@latest add @handset/express-routes

Lands at server/handset-routes.ts and expects HANDSET_API_KEY in your environment. Works with Express 4 and 5 on Node 18+.

Mount at /api/handset — the base path the components use by default:

import express from "express";
import { handsetRoutes } from "./handset-routes";

const app = express();
app.use("/api/handset", handsetRoutes());

Serving your React app from a different origin? Point the components at your API host with <HandsetProvider baseUrl="https://api.yourapp.com/api/handset"> and handle CORS as you do for the rest of your API.

One function is yours to implement. Everything the components can see flows through it:

async function resolveTenantId(req: Request): Promise<string | null> {
  if (!req.session?.user) throw { status: 401, message: "Sign in first" };
  return req.session.user.handsetTenantId;   // "tnt_…"
}

The resolved tenant is injected into every read — anything the browser claims is ignored. Return null for single-tenant accounts.

Identical to the Next.js proxy: only the endpoints the components need are forwarded, everything else 404s. Buying numbers, porting, compliance — none of that is reachable from the browser. Extend the list deliberately if you build more.