Route Protection

Route protection should depend on server-trusted state. The browser status flow is useful for UI feedback, but your backend should decide whether a user can access protected content.

Recommended pattern

Create a verification

Start the flow from your server and attach customerUserRef to link it to your user.

Confirm the result server-side

Process a webhook or fetch verifications.getResult(verificationId).

Store a verified flag

Write the minimum state you need to your user, membership, or session table.

Check that state in middleware

Protect pages with your framework middleware or route guards.

Next.js middleware

Import middleware from @authbound/nextjs/middleware, not from the package root. The root export exists for compatibility, but the dedicated middleware entry keeps Edge bundles smaller.

Next.js 16 renamed middleware.ts to proxy.ts. On Next.js 16, put the same code in proxy.ts; the default export and config work unchanged.

Use withAuthbound when you want SDK route matching and redirects, but keep the verification decision tied to your own session model.

middleware.ts

import { withAuthbound } from "@authbound/nextjs/middleware";
import { NextResponse } from "next/server";

export default withAuthbound({
  publicRoutes: ["/", "/verify", "/api/authbound/*"],
  protectedRoutes: ["/dashboard"],
  verifyPath: "/verify",
  isVerified: async (request) => {
    return request.cookies.get("app_verified")?.value === "true";
  },
  onVerificationRequired: (request) => {
    const url = new URL("/verify", request.url);
    url.searchParams.set("returnTo", request.nextUrl.pathname);
    return NextResponse.redirect(url);
  },
});

export const config = {
  matcher: ["/dashboard/:path*"],
};

Keep cookies small

Store only safe booleans in browser-visible state, such as:

{
  "verified": true,
  "age_over_18": true
}

Do not store raw credential data, names, dates of birth, addresses, document numbers, or wallet payloads in client-accessible cookies.

Server result lookup

import { AuthboundClient } from "@authbound/server";

const authbound = new AuthboundClient({
  apiKey: process.env.AUTHBOUND_SECRET_KEY!,
});

const result = await authbound.verifications.getResult(verificationId);

if (result.status === "verified") {
  await db.user.update({
    where: { id: userId },
    data: { ageVerifiedAt: new Date() },
  });
}

Start here

Identity verification

Credential issuance

AI

Recommended pattern

Next.js middleware

Keep cookies small

Server result lookup

​Recommended pattern

​Next.js middleware

​Keep cookies small

​Server result lookup

Recommended pattern

Next.js middleware

Keep cookies small

Server result lookup