Is there a recommended way of creating and destroying short-lived databases used for holding test fixtures?

I am playing around with hitting endpoints on the server… essentially creating an API that doesn’t use credentials for now. The app is on DO at the moment. A GET worked great (which calls a function that does something arbitrary on the server). However, a POST call returns a 403/<h1>Invalid anti-forgery token</h1>. Probably the right question is: how would I create an API for a Biff app so that other things can trigger events on the server (hardware buttons on Arduinos or the like/scripts on devices/etc). Can I issue credentials to users to make calls? In the case of, say, an Arduino I could bake the credential into the calls the device makes. Presumably a user would have an account on a Biff app first, then one would issue a credential that is tied to them. Just brainstorming here. I’m a fan of Swagger UI docs, btw… but that is outside the scope of this question but mentioning it since, down the road, it would be sweet to have automatic interactive documentation for the endpoints. I realize credentials and the anti forgery issue are probably separate ones. My immediate quick and dirty need is to be able to POST form data to a Biff app on DO but not from the context of a logged in user on a web page.

FYI, https://github.com/jacobobryant/biff/blob/9c11643516e8526a75c761f77139014241d5f114/new-project.clj#L13 if you are unfortunate enough to have a custom _JAVA_OPTIONS env variable (I've set it to force java into using ~/.config/java instead of ~/.java). Repro and suggested solution in:thread: