@sigid/next

Next.js helpers for SigID auth routes, sessions, and protected API routes.

Install

npm install @sigid/client @sigid/next

Auth Route Handlers

import { createSigIdClient } from "@sigid/client";
import { createAuthHandlers } from "@sigid/next";

const sigid = createSigIdClient({
  baseURL: process.env.NEXT_PUBLIC_SIGID_ISSUER_URL!,
  basePath: "/api/v1/identity",
  oauth: {
    clientId: process.env.NEXT_PUBLIC_SIGID_CLIENT_ID!,
    redirectUri: `${process.env.NEXT_PUBLIC_APP_URL}/oauth/callback`,
    scopes: ["openid", "profile", "email"],
  },
});

export const { GET, POST } = createAuthHandlers(sigid);

Protected API Routes

Use requireAccessToken() instead of decoding JWTs in application route code:

import { accessTokenErrorResponse, requireAccessToken } from "@sigid/next";

export async function GET(request: Request) {
  try {
    const claims = await requireAccessToken(request, {
      issuer: process.env.NEXT_PUBLIC_SIGID_ISSUER_URL!,
      audience: process.env.SIGID_API_AUDIENCE!,
      tenantId: process.env.SIGID_TENANT_ID!,
      scopes: ["projects:read"],
      allowedSubjectTypes: ["human"],
      dpop: {
        replayCheck: async (jti) => {
          // Atomically record jti in shared storage and return true only once.
          return await recordDpopJti(jti);
        },
      },
    });

    return Response.json({
      ok: true,
      subject: claims.subject,
      tenantId: claims.tenantId,
      scopes: claims.scopes,
    });
  } catch (error) {
    return accessTokenErrorResponse(error);
  }
}

requireAccessToken() owns Authorization header extraction and delegates cryptographic validation to @sigid/client. It supports Bearer and DPoP authorization schemes, and fails closed for missing access tokens, malformed Authorization syntax, unsupported schemes, missing or invalid DPoP proofs, DPoP replay, invalid JWT headers, wrong issuer, wrong audience, wrong tenant, insufficient scope, unexpected subject type, and unsupported delegation.

Keep issuer, audience, tenant, scope, and subject-type policy explicit at the resource boundary. When accepting DPoP-bound tokens, back replayCheck with atomic shared storage across resource-server instances.