Constant ATPROTO_CREDENTIALS 

pub const ATPROTO_CREDENTIALS: &[(&str, Credential)];

The credential each of those methods accepts. See auth::Credential for what each kind means, and that module’s “Why every public route is public” for why the read surface is Public on purpose: protocol-required for com.atproto.sync.* and com.atproto.repo.*’s reads, structurally required for describeServer and resolveHandle. The write half takes the agent token createAccount hands back, and routes::write_record / routes::apply_writes are where the authenticated DID is checked against the repository a write names. getSession takes the same credentials, and names the account they sign in as.