SDKs

Next.js App Router

@raha-ict/nextjs-oidc-auth provides Authorization Code with S256 PKCE, discovery, token/claim validation, encrypted HTTP-only cookie sessions, refresh handling, logout, client hooks, and Next.js 15 Middleware/Next.js 16 Proxy helpers.

npm install @raha-ict/nextjs-oidc-auth

// src/auth.ts
import { createAuth } from '@raha-ict/nextjs-oidc-auth/server'

export const auth = createAuth({
  issuer: process.env.OIDC_ISSUER!,
  clientId: process.env.OIDC_CLIENT_ID!,
  clientSecret: process.env.OIDC_CLIENT_SECRET,
  redirectUri: 'https://app.example.com/api/auth/callback',
  encryptionKeys: [process.env.AUTH_ENCRYPTION_KEY!],
  authorization: {
    scope: 'openid profile email offline_access',
    fetchUserInfo: true,
    extraParams: { ui_locales: 'fa en', ui_theme: 'dark' },
  },
})

// app/api/auth/[...action]/route.ts
import { auth } from '@/auth'
export const { GET, POST } = auth.handlers

Encryption keys must be at least 32 characters; keep the active key first during rotation. Server Components may read sessions, while Route Handlers and Server Actions can refresh and write updated cookies. Protect data access with requireSession() or requireAccessToken() even when a Proxy performs optimistic redirects.

For a client whose locale/theme changes at runtime, build the authorization request with the current values rather than relying on static extraParams.