github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-23 17:58:47 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Guide / Example request: OpenIddict (or Keycloak) + Next.js (App Router) + server/client API + refresh token #2770

New Issue
Open
opened 2026-03-13 10:19:13 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 10:19:13 -05:00
Owner
Copy Link
Copy Source

Originally created by @sorcerb on GitHub (Jan 26, 2026).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

I see the docs cover OAuth provider basics (OAuth plugin, socialProviders) and there’s a Next.js example, but there’s no full example showing how to use Better Auth with an OpenID provider (like OpenIddict/Keycloak), cookie-based access/refresh flow, SSR + CSR API calls together. I already have a working setup in Auth.js, and I’m stuck trying to reproduce it in Better Auth for over a week.

Problem

There is no official example for integrating:

  • OpenIddict or Keycloak
  • Next.js (App Router)
  • Server Components + Client Components
  • .NET API
  • Access token via HttpOnly cookies
  • Refresh token flow

In real projects we need:

  • server-side API calls (SSR)
  • client-side API calls (CSR)
  • automatic refresh when access token expires
  • secure storage (HttpOnly cookie, not localStorage)
  • same auth flow for both environments

Currently every developer has to invent their own solution.

Describe the solution you'd like

Requested example / guide

A complete minimal example would be extremely helpful:

  • OpenIddict (or Keycloak) configuration
  • .NET API with cookie-based auth
  • Next.js App Router
  • server-side fetch with credentials
  • client-side fetch with credentials
  • refresh token endpoint
  • token renewal logic
  • logout flow

Describe alternatives you've considered

Why this matters

Next.js App Router changes auth architecture significantly.
Most existing guides are outdated or only cover pages router or SPA mode.

Having an official guide would greatly improve adoption and DX.

Additional context

I already have a working production setup using Auth.js with OpenIddict and Next.js (App Router), including server/client API calls and refresh token flow.

While migrating to Better Auth, I couldn’t find any documented way to reproduce the same setup. Because of this, migration has been blocked for over a week. A guide or example covering this scenario would be extremely helpful.

Originally created by @sorcerb on GitHub (Jan 26, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. I see the docs cover OAuth provider basics (OAuth plugin, socialProviders) and there’s a Next.js example, but there’s no full example showing how to use Better Auth with an OpenID provider (like OpenIddict/Keycloak), cookie-based access/refresh flow, SSR + CSR API calls together. I already have a working setup in Auth.js, and I’m stuck trying to reproduce it in Better Auth for over a week. ### Problem There is no official example for integrating: - OpenIddict or Keycloak - Next.js (App Router) - Server Components + Client Components - .NET API - Access token via HttpOnly cookies - Refresh token flow In real projects we need: - server-side API calls (SSR) - client-side API calls (CSR) - automatic refresh when access token expires - secure storage (HttpOnly cookie, not localStorage) - same auth flow for both environments Currently every developer has to invent their own solution. ### Describe the solution you'd like ### Requested example / guide A complete minimal example would be extremely helpful: - OpenIddict (or Keycloak) configuration - .NET API with cookie-based auth - Next.js App Router - server-side fetch with credentials - client-side fetch with credentials - refresh token endpoint - token renewal logic - logout flow ### Describe alternatives you've considered ### Why this matters Next.js App Router changes auth architecture significantly. Most existing guides are outdated or only cover pages router or SPA mode. Having an official guide would greatly improve adoption and DX. ### Additional context I already have a working production setup using Auth.js with OpenIddict and Next.js (App Router), including server/client API calls and refresh token flow. While migrating to Better Auth, I couldn’t find any documented way to reproduce the same setup. Because of this, migration has been blocked for over a week. A guide or example covering this scenario would be extremely helpful.
GiteaMirror added the nextjsenhancement labels 2026-03-13 10:19:13 -05:00
GiteaMirror commented 2026-03-13 10:19:14 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Jan 26, 2026):

Thank you for your detailed request regarding the integration of OpenIddict or Keycloak with Next.js. It seems you are looking for an official example that covers various authentication workflows across server-side and client-side with a focus on using refresh tokens.

Currently, there are discussions within the community about improving support for first-party applications and token refresh capabilities in Better Auth. An official guide demonstrating the complete setup involving OpenIddict (or Keycloak), HTTP-only cookies for access tokens, and automatic refresh when access tokens expire would indeed be beneficial.

As of now, no official example exists for the specific scenario you've described, but there have been suggestions for enhancing the framework to support such use cases more comprehensively [1], [2]. You might also find community contributions or discussions on GitHub, where developers often share their configurations and examples.

If you're looking for real-time assistance or further clarifications, feel free to tag @bekacru or @ping__ in your next message—they'll provide insights directly from the Better Auth team!

What specific challenges are you currently facing in implementing this integration?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Jan 26, 2026): Thank you for your detailed request regarding the integration of OpenIddict or Keycloak with Next.js. It seems you are looking for an official example that covers various authentication workflows across server-side and client-side with a focus on using refresh tokens. Currently, there are discussions within the community about improving support for first-party applications and token refresh capabilities in Better Auth. An official guide demonstrating the complete setup involving OpenIddict (or Keycloak), HTTP-only cookies for access tokens, and automatic refresh when access tokens expire would indeed be beneficial. As of now, no official example exists for the specific scenario you've described, but there have been suggestions for enhancing the framework to support such use cases more comprehensively [[1]](https://github.com/better-auth/better-auth/issues/7394), [[2]](https://github.com/better-auth/better-auth/issues/1559). You might also find community contributions or discussions on GitHub, where developers often share their configurations and examples. If you're looking for real-time assistance or further clarifications, feel free to tag @bekacru or @ping__ in your next message—they'll provide insights directly from the Better Auth team! What specific challenges are you currently facing in implementing this integration? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels enhancement nextjs
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2770