Overview
@krakentech/blueprint-auth connects your Next.js application to Kraken's
authentication services. It provides login and logout flows, verified sessions,
token refresh, route protection, and authenticated GraphQL clients.
Your application supplies the UI and decides which operations a user can perform. Blueprint Auth resolves authentication; your server and Kraken must still enforce access to the requested resources.
Choose an authentication method​
| Method | When to use it |
|---|---|
| Kraken OAuth | Recommended for new integrations. Kraken's authorization server handles sign-in using OAuth 2.0 with PKCE. |
| Email & password | Maintain an existing integration where Kraken still supports password-based login. Your application collects the credentials. |
| Anonymous authentication | Give a customer scoped access through an expiring URL, without a full sign-in flow. |
| Masquerade | Let authorized support staff act in a customer's session using a masquerade token. |
Email & password authentication through the ObtainKrakenToken mutation is
deprecated. Prefer Kraken OAuth for new integrations; see the
email-and-password guide
for existing implementations.
Organization authentication is separate from customer sign-in. It provides server-only credentials for operations performed on behalf of the organization, including flows where no user is signed in. An organization token does not establish a user session or authorize a visitor to access customer data.
Set up your router​
Start with the guide for the router that serves your pages:
- App Router: configure server-side auth functions for Server Components and Server Actions. Add Route Handlers and client hooks when your application needs them.
- Pages Router: configure API handlers, client providers and hooks, and server-side auth functions for request-time rendering.
Both use a shared auth configuration. The routes you expose depend on your router and authentication method; a Server Action does not require a matching login or logout API route.
Protect access and manage sessions​
- Route protection covers proxy/middleware routing and the checks required at protected server boundaries. A hidden button or a page redirect is not an authorization check for an API route or Server Action.
- Session management explains reading session state, token verification, and refresh. Use session state for UI; resolve server-side auth before requesting protected data.
- Logout explains ending the browser session, redirects, and client-cache cleanup.
Go further​
Use the Advanced guides for forms, Cache Components, and logging. The API reference describes configuration and exported functions. When upgrading an existing integration, follow the migration guides for the versions you are crossing.