There are some extra features to handle security apart from the ones covered in the [Tutorial - User Guide: Security](../../tutorial/security/index.md).

/// tip

The next sections are **not necessarily "advanced"**.

And it's possible that for your use case, the solution is in one of them.

///

## Read the Tutorial first { #read-the-tutorial-first }

In the next sections you will see other options, configurations, and additional features.

/// tip

The next sections are **not necessarily "advanced"**.

And it's possible that for your use case, the solution is in one of them.

///

## Read the Tutorial first { #read-the-tutorial-first }

   * from least to greatest. If there are fewer than {@code k} elements present, all will be
   * included.
   *
   * <p>The implementation does not necessarily use a <i>stable</i> sorting algorithm; when multiple
   * elements are equivalent, it is undefined which will come first.
   *
   * <p><b>Java 8+ users:</b> Use {@code Streams.stream(iterable).collect(Comparators.least(k,

   * from least to greatest. If there are fewer than {@code k} elements present, all will be
   * included.
   *
   * <p>The implementation does not necessarily use a <i>stable</i> sorting algorithm; when multiple
   * elements are equivalent, it is undefined which will come first.
   *
   * <p><b>Java 8+ users:</b> Use {@code Streams.stream(iterable).collect(Comparators.least(k,

   * The order of the elements in the element set is unspecified.
   *
   * <p>If the element set supports any removal operations, these necessarily cause <b>all</b>
   * occurrences of the removed element(s) to be removed from the multiset. Implementations are not
   * expected to support the add operations, although this is possible.
   *

/// warning

This is a more or less advanced section. If you are just starting, you can skip it.

You don't necessarily need OAuth2 scopes, and you can handle authentication and authorization however you want.

But OAuth2 with scopes can be nicely integrated into your API (with OpenAPI) and your API docs.

You can see more details in [Starlette's official docs for Background Tasks](https://www.starlette.dev/background/).

## Caveat { #caveat }

If you need to perform heavy background computation and you don't necessarily need it to be run by the same process (for example, you don't need to share memory, variables, etc), you might benefit from using other bigger tools like [Celery](https://docs.celeryq.dev).

 * while a worker action that executes in a worker must declare that it executes in
 * a worker.
 *
 * However, a shared library used by both daemon and worker actions does not necessarily
 * care which runtimes it must execute in. The target runtimes it must support is a function
 * of the daemon and worker project that depends on it. Since both a daemon and worker

A **request** body is data sent by the client to your API. A **response** body is the data your API sends to the client.

Your API almost always has to send a **response** body. But clients don't necessarily need to send **request bodies** all the time, sometimes they only request a path, maybe with some query parameters, but don't send a body.

   * The order of the elements in the element set is unspecified.
   *
   * <p>If the element set supports any removal operations, these necessarily cause <b>all</b>
   * occurrences of the removed element(s) to be removed from the multiset. Implementations are not
   * expected to support the add operations, although this is possible.
   *