AuthKit
Reusable authentication boilerplate with JWT, Google OAuth 2.0 via Supabase, role-based access control, and protected route middleware. Plug-and-play for any Next.js project.
Overview
AuthKit is a production-ready authentication boilerplate designed to be dropped into any Next.js project. It provides a complete auth system out of the box — JWT-based session management, Google OAuth 2.0 via Supabase, role-based access control with granular permissions, and protected route middleware that secures both pages and API routes. The goal was to eliminate the repetitive boilerplate of setting up auth for every new project and provide a battle-tested, secure foundation.
Key Features
JWT-based session management with secure httpOnly cookies and automatic refresh
Google OAuth 2.0 integration via Supabase with one-click sign-in
Role-based access control with Admin, User, and custom role definitions
Next.js middleware for protecting routes at the edge before page load
Plug-and-play architecture — drop into any Next.js project with minimal config
Type-safe auth hooks and utilities with full TypeScript support
Tech Stack
Challenges & Solutions
Designing a middleware system that protects routes at the edge while supporting both page and API route protection — implemented using Next.js middleware with JWT verification at the edge runtime
Making the RBAC system flexible enough to support custom roles and granular permissions without over-engineering — solved with a permission matrix pattern that maps roles to route patterns
Ensuring secure token refresh without race conditions during concurrent requests — implemented with a token queue that serializes refresh attempts
Results & Impact
Zero-config setup — npm install, add env vars, and auth is working
Edge-verified JWT tokens with sub-10ms middleware execution time
Extensible role system supporting unlimited custom roles and permissions