server-functions

Create type-safe server RPCs in TanStack Start using createServerFn with validation and middleware.

Updated May 26, 2026
One-click install
npx skills add https://github.com/Albo-Club/albo-os --skill server-functions-albo-club
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: server-functions
Source: https://github.com/Albo-Club/albo-os/tree/main/.agents/skills/tanstack-start-core/server-functions
Command: npx skills add https://github.com/Albo-Club/albo-os --skill server-functions-albo-club

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? TanStack Start loaders are isomorphic and run on both client and server, so database queries, secret API keys, and file system access cannot live in loaders directly. This Skill teaches how to build type-safe server functions with createServerFn so server-only logic runs exclusively on the backend while remaining callable from loaders, components, and hooks. ## Core Features & Use Cases - Type-safe RPCs: Create GET/POST server functions with createServerFn, validate inputs with Zod or plain functions, and call them from loaders or the useServerFn hook. - Server context and error handling: Access request headers, set response status and Cache-Control headers, and throw errors, redirects, or notFound from handlers. - Security guardrails: Enforce auth inside handlers via middleware, avoid public caching of authenticated responses, and organize code into .functions.ts and .server.ts files. - Use Case: You need a mutation that creates an issue in the database from a form. Define a POST server function with a Zod validator, call it via useServerFn from the component, then invalidate the router cache so the loader re-reads persisted data. ## Quick Start Ask the AI to create a TanStack Start server function that validates input with Zod, enforces auth via middleware, and is called from a route loader.

Frequently Asked Questions about server-functions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a server function in TanStack Start?

Use createServerFn from @tanstack/react-start, optionally pass { method: 'POST' }, chain a validator for input, and define the logic in .handler(). Call it from loaders directly or from components via the useServerFn hook.

How do I validate server function input with Zod?

Pass a Zod schema to .validator() on the server function, such as z.object({ name: z.string().min(1) }). The parsed, typed data is then available as the data property inside the handler.

Can I put database queries directly in a TanStack Start loader?

No. Loaders are isomorphic and run on both client and server, so database queries and secret keys must go inside createServerFn handlers. The loader then calls the server function, which the client build replaces with an RPC stub.

Does a route beforeLoad guard protect my server functions?

No. Server functions are standalone API endpoints reachable without loading the route, so beforeLoad only protects the UI. Enforce auth inside the handler or via middleware on every server function that touches private data.

When should I use the useServerFn hook?

Use useServerFn when the server function throws redirect() or notFound(), since the hook wires the throw into the router. For plain data-returning functions, direct calls or useMutation work, but wrapping with useServerFn is always safe.

Why is Cache-Control public dangerous for authenticated responses?

Public caching lets CDNs and shared proxies serve one user's response to another, causing cross-tenant data leaks. For identity-dependent responses use Cache-Control private with a Vary header on Cookie and Authorization, or no-store for sensitive data.