# API

The structure of MERNKIT dictates that all routing is done by Routers in the routes folder.  All the authentication methods issue a JSON Web Token for continual API authentication. Therefore, Keep a close eye out for the following line:&#x20;

```
router.use(passport.authenticate("jwt", { session: false }));
```

**Anything above that line in a routes file is accessible without authentication.**&#x20;

**Anything below is protected.**&#x20;

When you create your own routes you can use this same line of code to protect your routes.&#x20;