Server Utilities
Server-side helpers for Server Components, Server Actions, and Route Handlers.
requireAuth
Get the authenticated user or redirect to login.
app/dashboard/page.tsx
1
2
3
4
5
6
7
import { requireAuth } from "@pylo/auth-nextjs";
export default async function DashboardPage() {
const user = await requireAuth();
// user exists here, or requireAuth already redirected
return <p>Welcome, {user.email}</p>;
}Redirects to /auth/login by default:
example.ts
1
const user = await requireAuth({ redirectTo: '/sign-in' });getUser
The current user, or null.
app/profile/page.tsx
1
2
3
4
5
6
7
8
9
10
11
import { getUser } from "@pylo/auth-nextjs";
export default async function ProfilePage() {
const user = await getUser();
if (!user) {
return <p>Not logged in</p>;
}
return <p>Email: {user.email}</p>;
}loggedIn
app/page.tsx
1
2
3
4
5
6
7
8
import { loggedIn } from "@pylo/auth-nextjs";
export default async function Page() {
if (await loggedIn()) {
return <AuthenticatedContent />;
}
return <PublicContent />;
}getAuthToken / getRefreshToken
The raw tokens from cookies, for custom API calls or debugging.
example.ts
1
2
3
4
import { getAuthToken, getRefreshToken } from "@pylo/auth-nextjs";
const authToken = await getAuthToken(); // string | undefined
const refreshToken = await getRefreshToken(); // string | undefinedrefreshTokens
Manual token refresh. The middleware already does this, so you need it only for custom flows.
example.ts
1
2
3
4
5
6
7
8
9
import { refreshTokens } from "@pylo/auth-nextjs";
const result = await refreshTokens();
if (result.success) {
console.log(result.authToken);
} else {
console.error(result.error?.message);
}Cookie configuration
Pylo stores tokens in HTTP-only cookies. Customize via cookieOptions on createPyloProxy() or
pyloAuth():
proxy.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
import { createPyloProxy } from "@pylo/auth-nextjs";
export const proxy = createPyloProxy({
publicPaths: ["/auth"],
cookieOptions: {
secure: true, // HTTPS only (default: true in production)
sameSite: "lax", // CSRF protection (default: 'lax')
domain: ".example.com", // cross-subdomain sharing
path: "/", // cookie path (default: '/')
authMaxAge: 3600, // auth token lifetime in seconds (default: 1 hour)
refreshMaxAge: 604800, // refresh token lifetime in seconds (default: 7 days)
},
});| Option | Type | Default | Description |
|---|---|---|---|
secure | boolean | true in production | Only send cookies over HTTPS |
sameSite | "strict" | "lax" | "none" | "lax" | CSRF protection setting |
domain | string | "" | Cookie domain for cross-subdomain sharing |
path | string | "/" | Cookie path |
authMaxAge | number | 3600 (1 hour) | Auth token cookie lifetime in seconds |
refreshMaxAge | number | 604800 (7 days) | Refresh token cookie lifetime in seconds |
Cookie names: pylo_auth_token (JWT auth token) and pylo_refresh_token (refresh token).
Function reference
| Function | Return type | Description |
|---|---|---|
requireAuth() | Promise<PyloUser> | Get user or redirect to login |
getUser() | Promise<PyloUser | null> | Get user or null |
loggedIn() | Promise<boolean> | Check if authenticated |
getAuthToken() | Promise<string | undefined> | Auth token from cookies |
getRefreshToken() | Promise<string | undefined> | Refresh token from cookies |
refreshTokens() | Promise<AuthResult> | Manually refresh tokens |