What is Server Endpoint (+server.js)?
The privileged layer for webhooks, secrets, and server-only logic. Anything touching keys, tokens, or private APIs lives here — never in components.
Related terms
Hooks (hooks.server.js)
The request gate for sessions, auth, and cookies across routes. Centralize identity checks here instead of repeating them per page.
Anon Key vs Service-Role Key
The public client key (safe in browsers, constrained by RLS) versus the privileged server key (bypasses policies, never leaves the server). Mixing them up is the classic Supabase security bug.
Webhook Verification
Cryptographically confirming payment callbacks actually came from the provider before fulfilling orders. Unverified webhooks let anyone grant themselves premium.
Svelte Runes
The `$state`, `$derived`, `$effect`, and `$props` primitives powering Svelte 5 reactivity. Runes are mandatory in generated code: explicit, compilable, and consistent across every component.
File-Based Routing
Pages defined by file location: `+page.svelte` renders, `+layout.svelte` wraps, `+server.js` serves data. The route tree is the app map — no separate router config to drift.
Load Function
Server-side data loading for a route before it renders. Load on the server for content crawlers and users need immediately; reach for client fetching only for interactive extras.