@djangocfg/api 2.1.360 → 2.1.361

package/src/_api/generated/helpers/auth.ts

@@ -79,7 +79,11 @@ function detectLocale(): string | null {
   return null;
 }
 
-/** Default baseUrl from `NEXT_PUBLIC_API_URL` (empty for static builds). */
+/** Default baseUrl from `NEXT_PUBLIC_API_URL`.
+ *
+ * Both browser and server use NEXT_PUBLIC_API_URL — requests go
+ * directly to Django without Next.js proxy.
+ */
 function defaultBaseUrl(): string {
   try {
     if (typeof process !== 'undefined' && process.env) {
@@ -90,8 +94,15 @@ function defaultBaseUrl(): string {
   return '';
 }
 
-/** Default API key fallback from `NEXT_PUBLIC_API_KEY`. */
+/** Default API key fallback from `NEXT_PUBLIC_API_KEY`.
+ *
+ * In the browser: returns null — requests go through the Next.js rewrite
+ * and the key is injected server-side (never exposed in the bundle).
+ * On the server: reads NEXT_PUBLIC_API_KEY as a fallback for SSR calls
+ * that bypass the rewrite (e.g. server components calling Django directly).
+ */
 function defaultApiKey(): string | null {
+  if (isBrowser) return null;
   try {
     if (typeof process !== 'undefined' && process.env?.NEXT_PUBLIC_API_KEY) {
       return process.env.NEXT_PUBLIC_API_KEY;