Building Secure API Routes in Next.js

Why Secure API Routes Matter

Next.js lets you build server‑side logic in pages/api/*.js. Securing these endpoints is critical:

- Protect sensitive data

- Prevent abuse and DDoS

- Enforce authentication

Authentication Strategies

1. JWT tokens

2. NextAuth.js sessions

3. API keys

Example: JWT Guard

// pages/api/secure.js

import jwt from 'jsonwebtoken'

export default function handler(req, res) {

const { authorization } = req.headers

if (!authorization) return res.status(401).end('No token')

const token = authorization.split(' ')[1]

try {

const user = jwt.verify(token, process.env.JWT_SECRET)

res.status(200).json({ data: `Hello ${user.name}` })

} catch (e) {

res.status(401).end('Invalid token')

}

}

Rate Limiting

Use middleware or libraries like `express-rate-limit`:

import rateLimit from 'express-rate-limit'

const limiter = rateLimit({ windowMs: 60*1000, max: 30 })

export default limiter(handler)

Error Handling

Always return consistent JSON errors:

res.status(400).json({ error: 'Missing parameter: id' })

Deployment Tips

- Store secrets in Vercel ENV variables

- Log via Vercel Analytics or Sentry

- Test with Postman or curl before launch