Authentication

Overview

Authentication is the gate to everything else, so don't hand-roll it. Use Auth.js (NextAuth) with the Drizzle adapter, or a hosted provider (Clerk/Supabase/WorkOS) if you want MFA and user management out of the box. The non-negotiables: httpOnly session cookies, server-side session resolution, and a single requireSession() helper used by every protected route and action.

When to use

• Adding login, signup, OAuth, or magic-link auth.
• Protecting routes, server actions, or route handlers.
• Resolving "who is the current user/org" on the server.

The pattern (Auth.js)