diff --git a/demo/nextjs/app/api/auth/[...all]/route.ts b/demo/nextjs/app/api/auth/[...all]/route.ts
index 16dfa39fb3..052a70575d 100644
--- a/demo/nextjs/app/api/auth/[...all]/route.ts
+++ b/demo/nextjs/app/api/auth/[...all]/route.ts
@@ -18,10 +18,7 @@ function addCorsHeaders(url: URL, headers: Headers) {
 		);
 		headers.set("Access-Control-Allow-Origin", "*");
 		headers.set("Access-Control-Allow-Headers", "authorization, content-type");
-		headers.set(
-			"Cache-Control",
-			"public, max-age=15, stale-while-revalidate=15, stale-if-error=86400",
-		);
+		// Leave Cache-Control to the library: token responses must be no-store (RFC 6749 §5.1).
 	}
 }