TJ Comments - Answer Overflow

Explore posts from servers

•Created by TJ on 4/25/2024 in #💻┃support

Protect Next.js route handlers with machine-to-machine application?

@Claire_Kinde I tried https://auth0.com/docs/quickstart/backend/nodejs/01-authorization Can I achieve the same using Kinde?

10 replies

KKinde

•Created by TJ on 4/25/2024 in #💻┃support

Protect Next.js route handlers with machine-to-machine application?

@Claire_Kinde Are you able to guide me on this? 🥹

10 replies

KKinde

•Created by TJ on 4/25/2024 in #💻┃support

Protect Next.js route handlers with machine-to-machine application?

Hi, I try to summarize what I did in the GitHub repository at https://github.com/tjhoo/kinde-client-credentials and the steps I performed in README.md

10 replies

KKinde

•Created by TJ on 4/25/2024 in #💻┃support

Protect Next.js route handlers with machine-to-machine application?

Hi, I have a Next.js application which I want the external applications to call the API using the access token obtain from the client credentials flow. I created one Next.js machine-to-machine application in Kinde. app/api/auth/[kindeAuth]/route.js

import { handleAuth } from "@kinde-oss/kinde-auth-nextjs/server";

export const GET = handleAuth();

import { handleAuth } from "@kinde-oss/kinde-auth-nextjs/server";

export const GET = handleAuth();

the protected API in app/api/payment/[id]/route.js

export const GET = (_, { params }) => Response.json({ message: params.id});

export const GET = (_, { params }) => Response.json({ message: params.id});

and protect the API in middleware.js

import { withAuth } from "@kinde-oss/kinde-auth-nextjs/middleware";

export const middleware = (req) => withAuth(req);

export const config = {
  matcher: ["/api/payment/:path*"],
};

import { withAuth } from "@kinde-oss/kinde-auth-nextjs/middleware";

export const middleware = (req) => withAuth(req);

export const config = {
  matcher: ["/api/payment/:path*"],
};

and I only defined these environment variables in my Next.js, .env.local

KINDE_CLIENT_ID=...
KINDE_CLIENT_SECRET=...
KINDE_ISSUER_URL=https://xxxx.kinde.com
KINDE_SITE_URL=http://localhost:3000

KINDE_CLIENT_ID=...
KINDE_CLIENT_SECRET=...
KINDE_ISSUER_URL=https://xxxx.kinde.com
KINDE_SITE_URL=http://localhost:3000

Now, I have requested an access token successfully,

curl --request POST \
--url $KINDE_ISSUER_URL/oauth2/token \
--header 'content-type: application/x-www-form-urlencoded' \
--header 'accept: application/json' \
--data grant_type=client_credentials \
--data client_id=$KINDE_CLIENT_ID \
--data client_secret=$KINDE_CLIENT_SECRET \
--data audience=test

curl --request POST \
--url $KINDE_ISSUER_URL/oauth2/token \
--header 'content-type: application/x-www-form-urlencoded' \
--header 'accept: application/json' \
--data grant_type=client_credentials \
--data client_id=$KINDE_CLIENT_ID \
--data client_secret=$KINDE_CLIENT_SECRET \
--data audience=test

but I got a 307 redirect when I called the API with the access token

curl --request GET \
--url 'http://localhost:3000/api/payment/b' \
--header 'content-type: application/json' \
--header 'authorization: Bearer xxx' -I
HTTP/1.1 307 Temporary Redirect
location: /api/auth/login
Date: Mon, 29 Apr 2024 10:09:12 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

curl --request GET \
--url 'http://localhost:3000/api/payment/b' \
--header 'content-type: application/json' \
--header 'authorization: Bearer xxx' -I
HTTP/1.1 307 Temporary Redirect
location: /api/auth/login
Date: Mon, 29 Apr 2024 10:09:12 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

Do you know what am I missing here?

10 replies

KKinde

•Created by TJ on 4/25/2024 in #💻┃support

Protect Next.js route handlers with machine-to-machine application?

10 replies

KKinde

•Created by TJ on 4/25/2024 in #💻┃support

Protect Next.js route handlers with machine-to-machine application?

@Peter (Kinde) I think what is missing from the document is to create an API (e.g. m2m) under Settings, and add this m2m API to the machine-to-machine application.

10 replies

KKinde

•Created by AlexanderO on 4/18/2024 in #💻┃support

How to protect APIs for SaaS with API-first approach?

Hi, in my use case I have a Next.js 14 application with route handlers. These route handlers are used by the Next.js pages. Now, I want to expose some of these route handlers to multiple external applications so that they can call the route handlers (or APIs) directly. How can I protect these route handlers?

7 replies

Gaming

Programming