start-server-functions

Use createServerFn from @tanstack/react-start with a method option, then chain .validator() for input validation and .handler() for the server-only logic. Call it with a single { data } argument from loaders, components, or other server functions.

useServerFn is mandatory when the server function throws redirect() or notFound(), because the hook wires the throw into the router for navigation. For plain-data functions it is optional; a direct call or useMutation works fine.

No, a beforeLoad redirect only protects the route UI. A server function is an independent HTTP endpoint reachable directly, so auth must be enforced inside the handler or via middleware on every function touching private data.

Yes, FormData is allowed as input only for POST server functions. Validate its shape manually in the validator, for example by checking instanceof FormData and coercing fields into an object validated with Zod.

The redirect throw is swallowed when the function is called directly in an onClick handler. Wrap the function with useServerFn in the component so the router handles the redirect or notFound throw.

Do not use server functions for public or cross-origin HTTP endpoints, which belong in server routes, or for composable middleware chains, which belong in dedicated middleware. Also avoid Next.js or Remix patterns like "use server" or loader/action.