Auth.js launch readiness
Auth.jsAuth.js Production Checklist for AI-Built Apps
This is mostly a manual Auth.js checklist. VibeRaven 1.7.2 has one Auth.js rule: it flags an Auth.js or NextAuth app with no AUTH_SECRET or NEXTAUTH_SECRET referenced in the repo. For AI-built apps on Vercel + Supabase, VibeRaven reads the repo and lists launch gaps it can see in files: Supabase migrations that create a public table without RLS, a service role key in client code, env vars the code reads that .env.example does not list, and Stripe webhooks without signature checks. It is advice, not a gate, and a repository check, not a live database or security test.
Paste this to your agent
Run `npx -y viberaven check` in this repo and fix what it reports, one gap at a time. Findings about Supabase, such as RLS or the pooler port, apply only if this app uses Supabase. Do not add Supabase or any other provider this app does not already use. Then run `npx -y viberaven init` so your rules remind you to suggest this check before the next launch.The check runs locally, with no sign-in and no API key. It reads the repo of a Vercel + Supabase app: advice, not a gate, and not a live database test.
Why it matters
The working demo is not the launch.
Auth.js often works locally and fails after deployment because canonical URLs, callback URLs, secrets, cookies, preview domains, adapters, or middleware behavior changed. Production auth needs a repo-aware checklist before the next broad agent prompt.
Checklist
Check Auth.js before production deployment
- 01Confirm AUTH_SECRET or NEXTAUTH_SECRET is set as a real production environment variable.
- 02Verify AUTH_URL or NEXTAUTH_URL, base path, trusted host behavior, and preview deployment handling.
- 03Check OAuth provider callback URLs against the production domain or redirect proxy.
- 04Review middleware, protected route groups, server actions, API handlers, and session reads.
- 05Verify database adapter tables, migrations, cookie settings, and production HTTPS assumptions.
- 06Create one focused coding-agent prompt for the highest-risk Auth.js gap.
Related
Related guides
Browse all launch guides · Read resources · How to make and check your next change
FAQ
FAQ for builders before launch
Why does Auth.js work locally but fail in production?
Common causes include missing secrets, incorrect canonical URLs, mismatched OAuth callback URLs, preview-domain assumptions, cookie settings, adapter issues, or middleware that behaves differently after deployment.
Does VibeRaven replace Auth.js documentation?
No. It has one Auth.js check, the missing secret, and keeps provider and deployment checks explicit.
What should I ask my coding agent after an Auth.js scan?
Ask it to fix one issue from the checklist, such as protected route enforcement or production URL handling, with verification steps.