# dynamic

**Kind:** Constant

**Source:** [`atloria-monorepo/apps/web/src/app/reader-api/[...path]/route.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/apps/web/src/app/reader-api/[...path]/route.ts#L20)

WEB-4 phase 1 — same-origin reader → public-API proxy.

The reader (on any docs origin) calls `/reader-api/<public-path>` instead of the
cross-origin public API. This handler runs on the web server, reads the httpOnly
reader-token cookie (set by /reader-api/session), attaches it to the upstream call
as the `X-Atloria-Reader-Token` header, and streams the response back — so the token
never reaches browser JS. Absent cookie → forwarded unauthenticated (non-gated docs
still work).

The reader passes the project id it already knows via the `x-reader-project` header
(a public id, not a secret) so the proxy can select the right per-project cookie.

Dormant until NEXT_PUBLIC_READER_COOKIE_AUTH is on and the reader routes through it.