@zezosoft/zezo-oauth-nextjs

Next.js App Router adapter for Zezo Auth.

Install

npm install @zezosoft/zezo-oauth-nextjs @zezosoft/oauth-core

Environment

ZEZO_CLIENT_ID=client_xxxxx
ZEZO_CLIENT_SECRET=secret_xxxxx
ZEZO_COOKIE_SECRET=use-a-long-random-secret-at-least-32-characters
ZEZO_REDIRECT_URI=http://localhost:3000/api/auth/callback

Create the client

// lib/zezo.ts

import { ZezoNextAuth } from '@zezosoft/zezo-oauth-nextjs';

export const zezo = new ZezoNextAuth({
  clientId: process.env.ZEZO_CLIENT_ID!,
  clientSecret: process.env.ZEZO_CLIENT_SECRET,
  redirectUri: process.env.ZEZO_REDIRECT_URI!,
  cookieSecret: process.env.ZEZO_COOKIE_SECRET!,
});

Login route

// app/api/auth/login/route.ts

import { zezo } from '@/lib/zezo';

export async function GET() {
  return zezo.login({
    returnTo: '/',
  });
}

Callback route

// app/api/auth/callback/route.ts

import { zezo } from '@/lib/zezo';

export async function GET(request: Request) {
  return zezo.callback(request);
}

Logout route

// app/api/auth/logout/route.ts

import { zezo } from '@/lib/zezo';

export async function GET() {
  return zezo.logout({
    postLogoutRedirectUri:
      'http://localhost:3000',
  });
}

Server-side session

import { zezo } from '@/lib/zezo';

export default async function Page() {
  const session =
    await zezo.getSession();

  if (!session) {
    return <div>Not logged in</div>;
  }

  return (
    <div>
      Hello {String(session.user?.name ?? '')}
    </div>
  );
}

Protected page

import { zezo } from '@/lib/zezo';

export default async function Page() {
  const session =
    await zezo.requireSession();

  return (
    <div>
      Hello {String(session.user?.name ?? '')}
    </div>
  );
}

First-party silent SSO

For a first-party client, if your OIDC authorization endpoint supports prompt=none:

return zezo.login({
  prompt: 'none',
});

The authorization server must return an OIDC error such as login_required when there is no active SSO session.

Important security notes

• Keep clientSecret server-side.
• Never expose the session cookie to browser JavaScript.
• Use HTTPS in production.
• cookieSecret should be a long random secret.
• The package stores the session in an HTTP-only signed cookie in this initial version. For high-scale or very large sessions, use a server-side session store instead.
• The core package generates PKCE and validates OAuth state. The current core package does not yet verify the ID-token signature/nonce cryptographically; add that before production deployment.