Custom Module Route run by External Cron Task I created a Drupal 8 module that cURL to a SFTP, grab a xml file and write it on the files folder. This module as a route (with _access: 'TRUE'), pointing to a controller that does the task.

While I'm connected as admin, and go to that route URL, the XML is downloaded as expected. When I do it as an anonymous user, it doesn't work, not throwing any error.
My goal is to have this route run by an external Cron task (every 5 minutes). However, when it runs, it's not recognized as admin, so it doesn't work.

What would be the best practice to have it working with a Cron Task but also secure enough so that not everybody could run it by going to that URL ?
I would make an API endpoint with authentication. Like:
mysite.com/api/crontasks?u=user&amp;p=password

And then authenticate it via controller!