createBolkAuth(config) creates the auth engine used by the Next.js route handler, middleware, and server helpers.
import { createBolkAuth } from "@bolkauth/core";
export const auth = createBolkAuth({
adapter,
secret: process.env.BOLKAUTH_SECRET!,
});
| Option | Type | Description |
|---|
adapter | BolkAuthAdapter | Database adapter for users, sessions, OAuth accounts, verification tokens, and metadata. |
secret | string | Secret used to sign session JWTs. Use at least 32 random characters. |
session: {
maxAge: 60 * 60 * 24 * 30,
updateAge: 60 * 60 * 24,
strategy: "jwt",
cookieName: "bolkauth.session",
}
| Option | Type | Description |
|---|
maxAge | number | Session lifetime in seconds. Defaults to 30 days. |
updateAge | number | Reserved for session refresh behavior. |
strategy | "jwt" | "database" | Session strategy field for configuration compatibility. Current middleware validates the JWT cookie. |
cookieName | string | Cookie name. Defaults to bolkauth.session. |
emailAndPassword: {
enabled: true,
minPasswordLength: 8,
requireEmailVerification: false,
}
| Option | Type | Description |
|---|
enabled | boolean | Enables email/password sign-up and sign-in configuration. |
minPasswordLength | number | Minimum password length. Defaults to 8. |
requireEmailVerification | boolean | Reserve this for flows that require verified email before access. |
email: {
sendMagicLink: async ({ identifier, url, token }) => {},
sendOTP: async ({ email, code, expiresAt }) => {},
verifyRedirectUrl: "/dashboard",
}
| Option | Description |
|---|
sendVerificationRequest | Send a verification email. |
sendMagicLink | Send the magic-link URL generated by BolkAuth. |
sendOTP | Send the numeric OTP code generated by BolkAuth. |
verifyRedirectUrl | Redirect target after a magic-link verification succeeds. |
socialProviders: {
github: {
clientId: process.env.GITHUB_CLIENT_ID!,
clientSecret: process.env.GITHUB_CLIENT_SECRET!,
scopes: ["user:email", "read:user"],
},
},
social: {
redirectUrl: "/dashboard",
}
socialProviders is keyed by provider name. Built-in OAuth helpers currently support common provider names such as github and google.
otp: {
expiresIn: 600,
codeLength: 6,
maxAttempts: 5,
onRateLimitExceeded: async (email) => {},
}
| Option | Type | Default |
|---|
expiresIn | number | 600 seconds |
codeLength | 4 | 6 | 8 | 6 |
maxAttempts | number | 5 |
onRateLimitExceeded | (email: string) => Promise<void> | Not set |
onboarding: {
enabled: true,
requiredForAccess: true,
redirectUrl: "/onboarding",
steps: ["profile", "team"],
}
Onboarding endpoints store progress through the adapter metadata methods. Use middleware to redirect users that need to complete setup.