Shared authorization for Nuxt 3 server API routes

Nuxt 3 maps files under server/api to Nitro routes, such as server/api/items.get.ts becoming /api/items. Handlers receive an H3 event object and run in the server-only runtime, so application authentication state from client-side plugins is not automatically available.

The goal is to apply one authorization check to every server/api endpoint instead of repeating token validation inside each handler. The missing constraint is where shared middleware or a wrapper should live in a Nuxt 3 project, given that auto-imported composables are not available in server/api handlers and Nuxt does not attach default route middleware to these endpoints.

Assume Nuxt 3 stable with Nitro as the server runtime. Practical verification would confirm whether a candidate middleware executes for /api/* routes before the handler runs.

Which directory or plugin layer is the supported place for shared server/api authorization? Should authorization run as Nitro route middleware, a Nuxt server middleware, or an imported handler wrapper? Does the approach remain stable across Nuxt 3 minor releases?