Private routes
App and admin routes are noindex and session protected.
Security and responsibilities
Clear boundaries for the account, provider, and SMS device.
BookFast documents which component holds access, billing, booking data, and operational state.
- 01
Account
- 02
Organization
- 03
Device
Separated secrets
Production keys use Cloudflare secret bindings, not source.
Device scope
Android uses a device session and private RLS.
01
The BookFast app uses organizations and roles
Every protected request checks the session and active business. Billing, membership, and admin mutations have separate authorization.
- Session
- Active organization
- Owner and members
- Admin boundary
02
The SMS device never receives a server key
Pairing creates a device-scoped session. Android performs no administrative delete, sees no other queue, and requests no inbound SMS access.
- Keystore
- Private RLS
- No server secret
- No READ_SMS
Your booking page can start taking shape today.
Create the account, choose a plan, and follow the guided setup.