Shared secrets, OAuth, SMTP and what is public

The two shared secrets

AUTH_SECRET and INTERNAL_API_TOKEN must be identical on both sides. Generate each with openssl rand -base64 32.

A mismatched INTERNAL_API_TOKEN is the one worth recognising on sight: every NextAuth adapter call carries it as X-Internal-Token, so a mismatch surfaces as an opaque OAuthCallbackError and sign-in fails with no obvious reason. To rotate either one: set the new value on the backend, then the frontend, then restart both. There is no overlap window, so calls in the gap 401 and sign-ins during it need a retry.

AUTH_SECRET signs NextAuth's session cookie on the frontend. The backend does not use it today; rotating both together is still the right habit.

OAuth providers

GitHub and Google ship as examples, each registered only when its credentials are present. Add or remove providers in frontend/auth.config.ts. Callback URLs and the step-by-step app registration: OAuth providers.

SMTP

The frontend's EMAIL_SERVER_* + EMAIL_FROM and the backend's SMTP_* + SMTP_FROM are independent because they live in different processes; both can point at one provider. Defaults target MailDev. See Email.

What's public

Only NEXT_PUBLIC_-prefixed variables reach the browser: today that is NEXT_PUBLIC_API_URL and NEXT_PUBLIC_SITE_URL. Everything else stays server-side, including the bearer session token, which lives in an httpOnly cookie and is never serialized into the page.