Guards
Protocol: async def can_activate(self, context: ExecutionContext) -> bool.
Stack with @use_guards. Built-ins: ApiKeyGuard, JwtGuard, OAuthGuard.
Python
from nitrostack import use_guards, OAuthGuard, ApiKeyGuard, JwtGuard
@use_guards(OAuthGuard)
async def search_flights(...):
...
Scaffold: nitrostack-py generate guard MyGuard.
Read tokens from context.metadata (authorization, headers, _oauth). OAuthGuard allows no-token when OAUTH_REQUIRED is unset.