Next.js

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

Package @revokegpt/firewall-next. Node runtime only: Next 16’s proxy.ts runs on Node; on Next 15.5 use withRevokeGPTMiddleware from @revokegpt/firewall-next/middleware and set runtime: 'nodejs' in the middleware config. The Edge runtime is not supported.

Use the documented matcher. A narrower one (for example ['/admin/:path*']) leaves every other path, including the reserved /__rg/session and /__rg/return routes, unprotected and unserved. Server Function calls are POSTs to the page’s own URL, so a rule for /admin covers them too.

proxy.ts

import { withRevokeGPT } from '@revokegpt/firewall-next/proxy';

export const proxy = withRevokeGPT({
  siteKey: process.env.RG_SITE_KEY ?? '',
  secretKey: process.env.RG_SECRET_KEY,
});

// Next reads `config` statically, so the literal must be in this file.
export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };

Not published yet

This integration package is built and tested in the repository but not published to its registry yet. Install it from a checkout until the first release.

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.