𝗔𝗱𝗱 𝗪𝗵𝗼𝗽 𝗢𝗔𝘂𝘁𝗵 𝘁𝗼 𝗬𝗼𝘂𝗿 𝗡𝗲𝘅𝘁.𝗷𝘀 𝗔𝗽𝗽

𝗔𝗱𝗱 𝗪𝗵𝗼𝗽 𝗢𝗔𝘂𝘁𝗵 𝘁𝗼 𝗬𝗼𝘂𝗿 𝗡𝗲𝘅𝘁.𝗷𝘀 𝗔𝗽𝗽

Stop building password systems. Stop hashing passwords. Stop managing email resets.

Whop handles this for you.

You need two packages:

• iron-session for encrypted cookies.
• zod for validation.

The setup uses a few files:

• Modules in lib.
• Route handlers in app/api/auth.
• A proxy.ts file.

The flow works like this:

• User clicks login.
• App generates a PKCE verifier and nonce.
• Whop manages consent.
• App trades the code for a token.
• App saves the profile in an encrypted cookie.

Security is a priority:

• All steps run on the server.
• Tokens never hit the browser.
• Middleware blocks unauthenticated users.
• A helper function protects server components.

One tip: Use a nonce. OpenID Connect requires it. Missing this breaks the flow.

Moving to production is fast:

• Create a production Whop app.
• Update your keys.
• Set the sandbox variable to false.

Source: https://dev.to/east/adding-user-authentication-to-a-nextjs-app-with-whop-oauth-b3b Optional learning community: https://docs.whop.com/