Next.js Auth Starter

Next.js App Router authentication starter for Tuurio ID with protected server routes and standards-based OpenID Connect.

Generated from Tuurio/auth_samples/auth_samples_nextjs. Submit implementation fixes upstream so they are not replaced by the next synchronized release.

What you get

• Standards-based OpenID Connect authentication with framework-native integration.
• Exact redirect and post-logout redirect handling.
• Protected-route and logout examples.
• A reviewed, pinned Tuurio provisioning workflow.

Quickstart

1. Create a repository with Use this template or clone this repository.
2. Follow the framework-specific prerequisites below.
3. Review and run this pinned provisioning command:

npx manage-tuurio-id@1.1.6 init --framework nextjs --project-dir . --auth browser --yes --output json --campaign github_nextjs --no-open --no-wait

4. Approve the exact command, then complete the secure browser handoff yourself.
5. Run the build and verify one real sign-in and sign-out.

Never paste credentials, client secrets, authorization codes, tokens, session cookies, or environment-file contents into an agent chat. Browser and native applications are public clients and must not contain a client secret.

Runtime and verification

• Runtime: Node.js 20+
• Package manager: npm
• Verification: npm ci && npm run build

Security model

This starter uses OpenID Connect Authorization Code flow. Browser and native clients use PKCE S256 and contain no client secret. Redirect and post-logout redirect URIs must match exactly. Identity comes from the established OIDC integration or an authenticated UserInfo request; decoded JWT payloads are never treated as validation. Keep generated local environment files ignored and never commit tokens or credentials.

Framework instructions

Tuurio Auth Next.js Demo

A Next.js demo that signs in with OAuth 2.0 / OpenID Connect, then displays token contents and a logout button.

Integration guide

• Detailed integration guide: Next.js example page
• General developer docs: Tuurio ID developers

Setup

1. Install dependencies:

npm install

2. Provision a tenant-specific public client through the human-approved browser handoff:

npx manage-tuurio-id@1.1.6 init --framework nextjs --project-dir . --auth browser --yes --output json --campaign github_nextjs --no-open --no-wait

3. Start the development server after the CLI writes the ignored local configuration:

npm run dev

Open http://localhost:3000.

Required client URLs

Configure your Tuurio client with these redirect URLs (matching your .env.local values):

Redirect URI: http://localhost:3000/auth/callback
Post-logout Redirect URI: http://localhost:3000/logout/callback

.env.local keys

NEXT_PUBLIC_TUURIO_ISSUER=https://your-tenant.id.tuurio.com
NEXT_PUBLIC_TUURIO_CLIENT_ID=replace-with-your-public-client-id
NEXT_PUBLIC_TUURIO_REDIRECT_URI=http://localhost:3000/auth/callback
NEXT_PUBLIC_TUURIO_POST_LOGOUT_REDIRECT_URI=http://localhost:3000/logout/callback
NEXT_PUBLIC_TUURIO_SCOPE=openid profile email

Deployment notes

• Register the exact production callback URLs before deploying. Preview URLs and production URLs usually need separate client entries or separate redirect URIs.
• NEXT_PUBLIC_* variables are exposed to the browser bundle. Do not place confidential client secrets in this sample.
• If you deploy behind a platform URL and a custom domain, decide which host should own the login callback and register only the hosts you actually use.
• Keep NEXT_PUBLIC_TUURIO_ISSUER tenant-specific, for example https://<tenantId>.id.tuurio.com.
• After changing environment variables in your deployment platform, trigger a fresh build. Next.js will not pick up changed public env vars from an old build artifact.

Notes:

• This is a public SPA client. Do not use or commit confidential client secrets.
• Keep redirect URIs and post-logout URIs exact.

License

Licensed under the Apache License, Version 2.0. See LICENSE.