AuthKit Next.js SDK

v4.0.1...v4.1.0" rel="noreferrer" target="_blank">4.1.0 (2026-05-15)

Features

• Add feature flags runtime client helper (https://github.com/workos/authkit-nextjs/issues/428" rel="noreferrer" target="_blank">#428) (https://github.com/workos/authkit-nextjs/commit/be6b9328dd75327211dcfc5be89c77b48bd18bd3" rel="noreferrer" target="_blank">be6b932)

v4.0.0...v4.0.1" rel="noreferrer" target="_blank">4.0.1 (2026-04-23)

Bug Fixes

• persist authenticationMethod in sealed session cookie (https://github.com/workos/authkit-nextjs/issues/410" rel="noreferrer" target="_blank">#410) (https://github.com/workos/authkit-nextjs/commit/a8f7def7cf3cbbb38dd1805e8da82a4b10bdf1d9" rel="noreferrer" target="_blank">a8f7def)

v3.0.1...v4.0.0" rel="noreferrer" target="_blank">4.0.0 (2026-04-23)

⚠ BREAKING CHANGES

• Upgrade @workos-inc/node to v9 (https://github.com/workos/authkit-nextjs/issues/407" rel="noreferrer" target="_blank">#407)
• set minimum Node.js version to 22.11.0 (https://github.com/workos/authkit-nextjs/issues/408" rel="noreferrer" target="_blank">#408)

Miscellaneous Chores

• set minimum Node.js version to 22.11.0 (https://github.com/workos/authkit-nextjs/issues/408" rel="noreferrer" target="_blank">#408) (https://github.com/workos/authkit-nextjs/commit/c3946698b6a7f369becce8ac9bba83fe7540300b" rel="noreferrer" target="_blank">c394669)
• Upgrade @workos-inc/node to v9 (https://github.com/workos/authkit-nextjs/issues/407" rel="noreferrer" target="_blank">#407) (https://github.com/workos/authkit-nextjs/commit/0183951e281146e973fd4a9884162b008a3dd38d" rel="noreferrer" target="_blank">0183951)

v3.0.0...v3.0.1" rel="noreferrer" target="_blank">3.0.1 (2026-04-20)

Bug Fixes

• isolate concurrent PKCE flows to prevent cookie clobbering (https://github.com/workos/authkit-nextjs/issues/403" rel="noreferrer" target="_blank">#403) (https://github.com/workos/authkit-nextjs/commit/3740a835df8b51027e8d5bf5011a3877c8648cec" rel="noreferrer" target="_blank">3740a83)
• set PKCE cookie in ensureSignedIn server action flow (https://github.com/workos/authkit-nextjs/issues/406" rel="noreferrer" target="_blank">#406) (https://github.com/workos/authkit-nextjs/commit/a55bb6467942042325d3015ea735ebd4fa7912d5" rel="noreferrer" target="_blank">a55bb64)

v2.17.0...v3.0.0" rel="noreferrer" target="_blank">3.0.0 (2026-03-25)

⚠ BREAKING CHANGES

• add OAuth state verification on callback to prevent CSRF attacks (https://github.com/workos/authkit-nextjs/issues/388" rel="noreferrer" target="_blank">#388)

Features

• add OAuth state verification on callback to prevent CSRF attacks (https://github.com/workos/authkit-nextjs/issues/388" rel="noreferrer" target="_blank">#388) (https://github.com/workos/authkit-nextjs/commit/ebef6e7b51556bf08b1714e2d3f5765a59d9c7f0" rel="noreferrer" target="_blank">ebef6e7)
• middleware: add authkitProxy and handleAuthkitProxy aliases for proxy.ts (https://github.com/workos/authkit-nextjs/issues/384" rel="noreferrer" target="_blank">#384) (https://github.com/workos/authkit-nextjs/commit/4c3f27b40c9a4ea295ef002dd0a2c32b9740f1ae" rel="noreferrer" target="_blank">4c3f27b)

Bug Fixes

• actions: catch TokenRefreshError in refreshAccessTokenAction to prevent 500s (https://github.com/workos/authkit-nextjs/issues/383" rel="noreferrer" target="_blank">#383) (https://github.com/workos/authkit-nextjs/commit/5c46c394fe00b9552665b51ca42b23d00416c704" rel="noreferrer" target="_blank">5c46c39)
• auth: return signInUrl from server actions to avoid CORS errors (https://github.com/workos/authkit-nextjs/issues/386" rel="noreferrer" target="_blank">#386) (https://github.com/workos/authkit-nextjs/commit/7d52400b8e62bc9d1a4f40b3400ae7586e511098" rel="noreferrer" target="_blank">7d52400)
• harden PKCE/CSRF for v3.0.0 release (https://github.com/workos/authkit-nextjs/issues/398" rel="noreferrer" target="_blank">#398) (https://github.com/workos/authkit-nextjs/commit/80548297ac45f15f0774b84e5981b80009412b8b" rel="noreferrer" target="_blank">8054829)

v2.16.1...v2.17.0" rel="noreferrer" target="_blank">2.17.0 (2026-03-13)

Features

• Automatically pass claim nonce for unclaimed environments (https://github.com/workos/authkit-nextjs/issues/389" rel="noreferrer" target="_blank">#389) (https://github.com/workos/authkit-nextjs/commit/67dfc921660e1b87e202472a18fa5e5868352275" rel="noreferrer" target="_blank">67dfc92)

v2.16.0...v2.16.1" rel="noreferrer" target="_blank">2.16.1 (2026-03-13)

Bug Fixes

• make PKCE opt-in to avoid breaking custom middleware proxies (https://github.com/workos/authkit-nextjs/issues/392" rel="noreferrer" target="_blank">#392) (https://github.com/workos/authkit-nextjs/commit/9e09fcb85f16c73f3ed3bc00e2799fadc685feca" rel="noreferrer" target="_blank">9e09fcb)

v2.15.0...v2.16.0" rel="noreferrer" target="_blank">2.16.0 (2026-03-11)

Features

• add PKCE support for OAuth 2.1 compliance (https://github.com/workos/authkit-nextjs/issues/374" rel="noreferrer" target="_blank">#374) (https://github.com/workos/authkit-nextjs/commit/de01c7fde33b6d0b65024741a5ba3c492686ec4a" rel="noreferrer" target="_blank">de01c7f)

Bug Fixes

• improve compatibility with non-Next.js environments (https://github.com/workos/authkit-nextjs/issues/378" rel="noreferrer" target="_blank">#378) (https://github.com/workos/authkit-nextjs/commit/734311a827a42502d6d2d7897ddbbdfd2d5e3b94" rel="noreferrer" target="_blank">734311a)
• resolve Dependabot security alerts (https://github.com/workos/authkit-nextjs/issues/380" rel="noreferrer" target="_blank">#380) (https://github.com/workos/authkit-nextjs/commit/519dccff6c76a6d7feb23dabe40e95405406b9f7" rel="noreferrer" target="_blank">519dccf)

v2.14.0...v2.15.0" rel="noreferrer" target="_blank">2.15.0 (2026-02-25)

Features

• Add returnTo option to getSignInUrl and getSignUpUrl functions (https://github.com/workos/authkit-nextjs/issues/375" rel="noreferrer" target="_blank">#375) (https://github.com/workos/authkit-nextjs/commit/fc7570897068a082f657a60261f5c51d63f1faa5" rel="noreferrer" target="_blank">fc75708)

What's Changed

• chore: switch from npm to pnpm by @nicknisi in #360
• docs: add warning about catch-all middleware matcher breaking styles by @nicknisi in #355
• chore: migrate from Jest to Vitest by @nicknisi in #367
• chore: upgrade @workos-inc/node to v8 by @nicknisi in #368
• Add example app as pnpm workspace package by @nicknisi in #370
• v2.14.0 by @nicknisi in #369

Full Changelog: v2.13.0...v2.14.0

What's Changed

• Add context7.json to repo by @nicknisi in #345
• feat: enable npm Trusted Publishers by @nicknisi in #346
• feat: add TokenRefreshError with userId and sessionId for debugging by @nicknisi in #349
• feat: add composable proxy/middleware helpers by @nicknisi in #348
• fix(tests): move window.location patching and restoration to beforeEach/afterEach by @sundaray in #350
• fix: avoid calling headers() in middleware context by @nicknisi in #354
• fix(test): restore document.querySelector mock in afterEach by @sundaray in #356
• fix(test): restore process.env after each test by @sundaray in #357
• v2.13.0 by @nicknisi in #358

New Contributors

• @sundaray made their first contribution in #350

Full Changelog: v2.12.2...v2.13.0

What's Changed

• fix: bump Next.js dev dependency to patched version by @nickcollisson-workos in #343
• v2.12.2 by @nicknisi in #344

Full Changelog: v2.12.1...v2.12.2

What's Changed

• Socket workflow integration by @nickcollisson-workos in #338
• Switch runner to ubuntu-latest for socket action by @nicknisi in #339
• fix: bump Next.js dev dependency to patched version by @nicknisi in #341
• fix: handle full URLs in returnPathname to prevent malformed redirects by @nicknisi in #340
• fix: handle full URLs in returnPathname to prevent malformed redirects by @nicknisi in #342

New Contributors

• @nickcollisson-workos made their first contribution in #338

Full Changelog: v2.12.0...v2.12.1

What's Changed

• feat: Add initialAuth to AuthkitProvider by @danielr18 in #323

Full Changelog: v2.11.1...v2.12.0

What's Changed

• docs: fix state parameter type documentation to match implementation by @nicknisi in #327
• Prevent caching authenticated pages (94cf438)

Full Changelog: v2.11.0...v2.11.1

What's Changed

• feat: support returnTo on Impersonation stop by @danielr18 in #322
• feat: don't load organization unless impersonating by @danielr18 in #324
• Add validateApiKey function by @nholden in #328
• Add Next.js 16 support by @nicknisi in #331

New Contributors

• @danielr18 made their first contribution in #322

Full Changelog: v2.10.0...v2.11.0

This update simply updates to @workos-inc/node v8.0.0-rc.1.

Full Changelog: v2.10.0...v3.0.0-beta.1

What's Changed

• Fix docs around eagerAuth usage by @nicknisi in #313
• docs: Add featureFlag usage to the README by @birdcar in #318
• feat: Add support for passing custom state data through authentication flow by @nicknisi in #314

New Contributors

• @birdcar made their first contribution in #318

Full Changelog: v2.9.0...v2.10.0

What's Changed

• Specify 'use client' to differentiate between a server component. by @brandonin in #310
• Allow onSuccess callback to update session by @nholden in #311

New Contributors

• @brandonin made their first contribution in #310
• @nholden made their first contribution in #311

Full Changelog: v2.8.0...v2.9.0

What's Changed

• Add roles to session JWT by @atainter in #308
• v2.8.0 by @atainter in #309

New Contributors

• @atainter made their first contribution in #308

Full Changelog: v2.7.1...v2.8.0

What's Changed

• Fix SSR hydration mismatch in tokenStore by @nicknisi in #306

Full Changelog: v2.7.0...v2.7.1

What's Changed

• docs: improve middleware documentation with security best practices by @nicknisi in #293
• Add eager auth for synchronous token access by @nicknisi in #301
• reduce test coverage thresholds to 80% by @nicknisi in #303
• Move tests inline by @nicknisi in #304

Full Changelog: v2.6.0...v2.7.0

What's Changed

• add prompt to getAuthorizationURL by @jameslcarpino in #292
• fix: allow signOut to work outside middleware coverage by @nicknisi in #296
• Fix: Show loading state during initial token fetch to prevent flash by @nicknisi in #297

New Contributors

• @jameslcarpino made their first contribution in #292

Full Changelog: v2.5.0...v2.6.0

What's Changed

• Fix token staleness in inactive browser tabs by @nicknisi in #290

Full Changelog: v2.4.6...v2.5.0

What's Changed

• Fix intermittent Turbopack build errors by removing .js extensions from Next.js imports by @nicknisi in #284

Full Changelog: v2.4.5...v2.4.6

What's Changed

• Clean up getCookieOptions and use in signOut to respect all options when delting cookie by @nicknisi in #281

Full Changelog: v2.4.4...v2.4.5

What's Changed

• Fix: Correct typos in README by @triplechecker-com in #278
• docs: Update README to include explicitly passing baseURL in containerized environments by @heatherfaerber in #279
• fix: improve useAccessToken timer management and prevent background flashing by @nicknisi in #280

New Contributors

• @triplechecker-com made their first contribution in #278
• @heatherfaerber made their first contribution in #279

Full Changelog: v2.4.3...v2.4.4

What's Changed

• Fix: Token refresh logic improvements by @nicknisi in #276

Full Changelog: v2.4.2...v2.4.3

What's Changed

• docs: Add default values for all optional environment variables by @nicknisi in #272
• Fix: Prevent infinite token refresh loop for long-lived sessions by @nicknisi in #273

Full Changelog: v2.4.1...v2.4.2

What's Changed

• Revert "fix ESM import extensions (#249)" by @nicknisi in #270

Important

This fixes a bug introduced in v2.4.0 when running with --turbo. See #268 for more details.

Full Changelog: v2.4.0...v2.4.1