Hacker News Reader

I thought you were supposed to avoid sessions and states in apps built on top of RESTful APIs. What am I missing?

Well, you can always protect an endpoint by requiring "whatever" condition. Impossing conditions for requests is different than "having a state".

State happens in the client, requests to the backend come with pre-conditions.

That this is not REST api level session/state.

It's an auth session, which is orthogonal (and transparent) to the REST api (e.g with cookies).