Next.js in Practice · Part 2815 min read
Client-Only Auth - Tokens in the Browser
Auth handled entirely in the browser against an external API, compatible with output 'export': an AuthProvider, where to keep tokens, refresh-token rotation with a fetch wrapper and TanStack Query, client route guards, OAuth PKCE, cross-tab logout, and how it compares with server-aware auth.