Protect server endpoints
A Route Handler needs to reject requests from users who are not signed in.
Clerk · Function
auth
auth() provides the current authentication context for Next.js App Router server code. It exposes the Auth object, route-protection capabilities, and a sign-in redirect helper.
How it works
In a Next.js App Router server context, call auth() to obtain the active request's Auth object and redirectToSignIn() helper. Inspect its authentication data, use protect() for authentication or authorization checks, and use getToken() when a session token or custom JWT must be sent to another server.
Syntax
await auth()Parameters
| Name | Type | Description |
|---|---|---|
| | No parameters are documented for the auth() helper. |
Returns
A promise resolving to the Auth object and a redirectToSignIn() method.
Key points
- Call auth() in a server context to access the active request's authentication data.
- protect() supports both sign-in checks and access-control decisions.
- The helper's main result is an Auth object containing the current authentication context.
- auth() also provides a helper for sending unauthenticated users to the sign-in page.
- isAuthenticated provides a direct boolean check for whether the request has a signed-in user.
- Use getToken() when another server needs a session token or custom JWT.
Common mistakes
- The helper is not available in the Pages Router.
- Do not call auth() from client components.
- Configure Clerk middleware before relying on auth() in application routes.
Example: Protect a Route Handler with auth()
import { auth } from '@clerk/nextjs/server'
export async function GET() {
const { isAuthenticated, userId } = await auth()
if (!isAuthenticated) {
return new Response('Unauthorized', { status: 401 })
}
return Response.json({ userId })
}This Route Handler reads the server-side auth state and returns the authenticated user's ID, or a 401 response when no user is signed in.
When to use it
Render server-side content conditionally
A Server Component needs the current user's authentication state.
Forward a session token
A server request must call an external API on behalf of the current session.
Apply authorization rules
A route needs to enforce roles, permissions, features, or plans.
Interview questions
QWhat does auth() return?
auth() is a server-side App Router helper that returns the current Auth object and a redirectToSignIn() method. The Auth object exposes the current authentication state and methods such as protect() and getToken().
Follow-up: How would you protect an endpoint without redirecting? Check isAuthenticated and return an HTTP 401 response, or use protect() with behavior appropriate for the endpoint.
QHow do you check authentication and authorization?
Use auth().isAuthenticated to determine whether a signed-in user exists. For more complete access rules, use the returned protect() method to enforce authentication or authorization.
Follow-up: How can authorization be enforced? Pass the relevant authorization requirements to protect(), such as a role, permission, feature, or plan.
QWhen should getToken() be used?
Use getToken() when a server must forward the current session token or a custom JWT template to another API. It retrieves the token associated with the current authentication context.
Follow-up: What changes for machine-authenticated requests? The Auth object reflects machine-level authentication data rather than ordinary user-session details.
Related
protect()redirectToSignIn()getToken()isAuthenticatedclerkMiddleware()Auth object