Protect a server component
A server-rendered page needs to allow only signed-in users.
Kinde · Function
getKindeServerSession
getKindeServerSession provides server-side Kinde authentication data in Next.js App Router server components. Use its returned methods to check authentication and retrieve user, authorization, organization, or token information.
How it works
In a Next.js App Router server component, getKindeServerSession provides functions for checking authentication and reading Kinde user data. Invoke the helper, then await methods such as isAuthenticated and getUser to decide whether to render protected content.
Syntax
const { isAuthenticated, getUser } = getKindeServerSession();Returns
An object containing server-session functions, including authentication, user, authorization, organization, and token helpers.
Key points
- Use the helper from a Next.js server component to access the authenticated user’s Kinde data.
- Import and call getKindeServerSession from the Next.js server SDK.
- A protected page can perform its authentication check before handling or rendering its content.
Common mistakes
- Session functions are asynchronous, so await their results.
Example: Read a server session
import { getKindeServerSession } from "@kinde-oss/kinde-auth-nextjs/server";
export default async function Page() {
const { isAuthenticated, getUser } = getKindeServerSession();
if (!(await isAuthenticated())) return <p>Sign in required</p>;
const user = await getUser();
return <p>Welcome, {user?.given_name}</p>;
}Call the helper in an async Next.js server component, then await its session functions before rendering protected content.
When to use it
Read the current user
A page needs the current Kinde identity for personalized output.
Access a server token
Server code must obtain an access token for an authorized downstream request.
Interview questions
QWhat is getKindeServerSession used for?
getKindeServerSession is a server-side helper for retrieving Kinde authentication data in a Next.js server component. It exposes methods such as isAuthenticated and getUser, which are used to protect rendering and access the current user.
Follow-up: How should a protected page handle an unauthenticated request? Check isAuthenticated first and return an appropriate response or redirect instead of rendering protected content.
QHow do you protect a Next.js server component?
Call getKindeServerSession in the server component, destructure the required session methods, and await them. The current documentation shows isAuthenticated for the access check and getUser for user data.
Follow-up: Why avoid reading the session only in client code? Server-side checks protect the initial request and keep authentication decisions close to the protected resource.
QWhat kinds of data can the helper provide?
The helper exposes server-side Kinde Auth data, including access-token and user-session operations documented for the Next.js App Router SDK. The exact methods should be selected according to whether the component needs identity, authorization, or token data.
Follow-up: When would an access token be preferable to user data? Use the token when the server component must call an authorized downstream API on the user's behalf.
Related
isAuthenticatedgetUsergetAccessTokenRawaccessTokenRawgetPermissionsgetOrganizationuseKindeAuth