@workos-inc/authkit-nextjs 0.5.3 → 0.6.2

package/README.md

@@ -35,6 +35,17 @@ openssl rand -base64 24
 
 To use the `signOut` method, you'll need to set your app's homepage in your WorkOS dashboard settings under "Redirects".
 
+### Optional configuration
+
+Certain environment variables are optional and can be used to debug or configure cookie settings.
+
+```sh
+WORKOS_COOKIE_MAX_AGE='600' # maximum age of the cookie in seconds. Defaults to 31 days
+WORKOS_API_HOSTNAME='api.workos.com' # base WorkOS API URL
+WORKOS_API_HTTPS=true # whether to use HTTPS in API calls
+WORKOS_API_PORT=3000 # port to use for API calls
+```
+
 ## Setup
 
 ### Callback route
@@ -167,6 +178,30 @@ export default function App() {
 }
 ```
 
+### Get the access token
+
+Sometimes it is useful to obtain the access token directly, for instance to make API requests to another service.
+
+```jsx
+import { getUser } from '@workos-inc/authkit-nextjs';
+
+export default async function HomePage() {
+  const { accessToken } = await getUser();
+
+  if (!accessToken) {
+    return <div>Not signed in</div>;
+  }
+
+  const serviceData = await fetch('/api/path', {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+    },
+  });
+
+  return <div>{serviceData}</div>;
+}
+```
+
 ### Debugging
 
 To enable debug logs, initialize the middleware with the debug flag enabled.

package/dist/cjs/cookie.d.ts

@@ -4,5 +4,6 @@ declare const cookieOptions: {
     httpOnly: boolean;
     secure: boolean;
     sameSite: "lax";
+    maxAge: number;
 };
 export { cookieName, cookieOptions };

package/dist/cjs/cookie.js

@@ -11,6 +11,10 @@ const cookieOptions = {
     httpOnly: true,
     secure: isSecureProtocol,
     sameSite: 'lax',
+    // Defaults to 400 days, the maximum allowed by Chrome
+    // It's fine to have a long cookie expiry date as the access/refresh tokens
+    // act as the actual time-limited aspects of the session.
+    maxAge: env_variables_js_1.WORKOS_COOKIE_MAX_AGE ? parseInt(env_variables_js_1.WORKOS_COOKIE_MAX_AGE, 10) : 60 * 60 * 24 * 400,
 };
 exports.cookieOptions = cookieOptions;
 //# sourceMappingURL=cookie.js.map

package/dist/cjs/cookie.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/cookie.ts"],"names":[],"mappings":";;;AAAA,yDAAyD;AAEzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,sCAAmB,CAAC,CAAC;AACjD,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAE3D,MAAM,UAAU,GAAG,aAAa,CAAC;AAQxB,gCAAU;AAPnB,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,KAAc;CACzB,CAAC;AAEmB,sCAAa"}
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/cookie.ts"],"names":[],"mappings":";;;AAAA,yDAAgF;AAEhF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,sCAAmB,CAAC,CAAC;AACjD,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAE3D,MAAM,UAAU,GAAG,aAAa,CAAC;AAYxB,gCAAU;AAXnB,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,KAAc;IACxB,sDAAsD;IACtD,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,EAAE,wCAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;CACzF,CAAC;AAEmB,sCAAa"}

package/dist/cjs/env-variables.d.ts

@@ -2,4 +2,8 @@ declare const WORKOS_CLIENT_ID: string;
 declare const WORKOS_API_KEY: string;
 declare const WORKOS_REDIRECT_URI: string;
 declare const WORKOS_COOKIE_PASSWORD: string;
-export { WORKOS_CLIENT_ID, WORKOS_API_KEY, WORKOS_REDIRECT_URI, WORKOS_COOKIE_PASSWORD };
+declare const WORKOS_API_HOSTNAME: string | undefined;
+declare const WORKOS_API_HTTPS: string | undefined;
+declare const WORKOS_API_PORT: string | undefined;
+declare const WORKOS_COOKIE_MAX_AGE: string | undefined;
+export { WORKOS_CLIENT_ID, WORKOS_API_KEY, WORKOS_REDIRECT_URI, WORKOS_COOKIE_PASSWORD, WORKOS_API_HOSTNAME, WORKOS_API_HTTPS, WORKOS_API_PORT, WORKOS_COOKIE_MAX_AGE, };

package/dist/cjs/env-variables.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKOS_COOKIE_PASSWORD = exports.WORKOS_REDIRECT_URI = exports.WORKOS_API_KEY = exports.WORKOS_CLIENT_ID = void 0;
+exports.WORKOS_COOKIE_MAX_AGE = exports.WORKOS_API_PORT = exports.WORKOS_API_HTTPS = exports.WORKOS_API_HOSTNAME = exports.WORKOS_COOKIE_PASSWORD = exports.WORKOS_REDIRECT_URI = exports.WORKOS_API_KEY = exports.WORKOS_CLIENT_ID = void 0;
 function getEnvVariable(name) {
     const envVariable = process.env[name];
     if (!envVariable) {
@@ -8,6 +8,9 @@ function getEnvVariable(name) {
     }
     return envVariable;
 }
+function getOptionalEnvVariable(name) {
+    return process.env[name];
+}
 const WORKOS_CLIENT_ID = getEnvVariable('WORKOS_CLIENT_ID');
 exports.WORKOS_CLIENT_ID = WORKOS_CLIENT_ID;
 const WORKOS_API_KEY = getEnvVariable('WORKOS_API_KEY');
@@ -16,6 +19,14 @@ const WORKOS_REDIRECT_URI = getEnvVariable('WORKOS_REDIRECT_URI');
 exports.WORKOS_REDIRECT_URI = WORKOS_REDIRECT_URI;
 const WORKOS_COOKIE_PASSWORD = getEnvVariable('WORKOS_COOKIE_PASSWORD');
 exports.WORKOS_COOKIE_PASSWORD = WORKOS_COOKIE_PASSWORD;
+const WORKOS_API_HOSTNAME = getOptionalEnvVariable('WORKOS_API_HOSTNAME');
+exports.WORKOS_API_HOSTNAME = WORKOS_API_HOSTNAME;
+const WORKOS_API_HTTPS = getOptionalEnvVariable('WORKOS_API_HTTPS');
+exports.WORKOS_API_HTTPS = WORKOS_API_HTTPS;
+const WORKOS_API_PORT = getOptionalEnvVariable('WORKOS_API_PORT');
+exports.WORKOS_API_PORT = WORKOS_API_PORT;
+const WORKOS_COOKIE_MAX_AGE = getOptionalEnvVariable('WORKOS_COOKIE_MAX_AGE');
+exports.WORKOS_COOKIE_MAX_AGE = WORKOS_COOKIE_MAX_AGE;
 if (WORKOS_COOKIE_PASSWORD.length < 32) {
     throw new Error('WORKOS_COOKIE_PASSWORD must be at least 32 characters long');
 }

package/dist/cjs/env-variables.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-variables.js","sourceRoot":"","sources":["../../src/env-variables.ts"],"names":[],"mappings":";;;AAAA,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,kBAAkB,CAAC,CAAC;AASnD,4CAAgB;AARzB,MAAM,cAAc,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;AAQ7B,wCAAc;AAPzC,MAAM,mBAAmB,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAOvB,kDAAmB;AAN9D,MAAM,sBAAsB,GAAG,cAAc,CAAC,wBAAwB,CAAC,CAAC;AAMR,wDAAsB;AAJtF,IAAI,sBAAsB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;IACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"env-variables.js","sourceRoot":"","sources":["../../src/env-variables.ts"],"names":[],"mappings":";;;AAAA,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,kBAAkB,CAAC,CAAC;AAc1D,4CAAgB;AAblB,MAAM,cAAc,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;AActD,wCAAc;AAbhB,MAAM,mBAAmB,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAchE,kDAAmB;AAbrB,MAAM,sBAAsB,GAAG,cAAc,CAAC,wBAAwB,CAAC,CAAC;AActE,wDAAsB;AAbxB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;AAcxE,kDAAmB;AAbrB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;AAclE,4CAAgB;AAblB,MAAM,eAAe,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;AAchE,0CAAe;AAbjB,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;AAc5E,sDAAqB;AAZvB,IAAI,sBAAsB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;IACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC"}

package/dist/cjs/interfaces.d.ts

@@ -18,6 +18,7 @@ export interface UserInfo {
     organizationId?: string;
     role?: string;
     impersonator?: Impersonator;
+    accessToken: string;
 }
 export interface NoUserInfo {
     user: null;
@@ -25,6 +26,7 @@ export interface NoUserInfo {
     organizationId?: undefined;
     role?: undefined;
     impersonator?: undefined;
+    accessToken?: undefined;
 }
 export interface AccessToken {
     sid: string;

package/dist/cjs/session.js

@@ -28,6 +28,19 @@ async function updateSession(request, debug, middlewareAuth) {
     // Record that the request was routed through the middleware so we can check later for DX purposes
     newRequestHeaders.set(middlewareHeaderName, 'true');
     newRequestHeaders.delete(sessionHeaderName);
+    const url = new URL(env_variables_js_1.WORKOS_REDIRECT_URI);
+    if (middlewareAuth.enabled &&
+        url.pathname === request.nextUrl.pathname &&
+        !middlewareAuth.unauthenticatedPaths.includes(url.pathname)) {
+        // In the case where:
+        // - We're using middleware auth mode
+        // - The redirect URI is in the middleware matcher
+        // - The redirect URI isn't in the unauthenticatedPaths array
+        //
+        // then we would get stuck in a login loop due to the redirect happening before the session is set.
+        // It's likely that the user accidentally forgot to add the path to unauthenticatedPaths, so we add it here.
+        middlewareAuth.unauthenticatedPaths.push(url.pathname);
+    }
     const matchedPaths = middlewareAuth.unauthenticatedPaths.filter((pathGlob) => {
         const pathRegex = getMiddlewareAuthPathRegex(pathGlob);
         return pathRegex.exec(request.nextUrl.pathname);
@@ -80,7 +93,8 @@ async function updateSession(request, debug, middlewareAuth) {
         return response;
     }
     catch (e) {
-        console.warn('Failed to refresh', e);
+        if (debug)
+            console.log('Failed to refresh. Deleting cookie and redirecting.', e);
         const response = server_1.NextResponse.next({
             request: { headers: newRequestHeaders },
         });
@@ -105,11 +119,7 @@ function getMiddlewareAuthPathRegex(pathGlob) {
     }
 }
 async function getUser({ ensureSignedIn = false } = {}) {
-    const hasMiddleware = Boolean((0, headers_1.headers)().get(middlewareHeaderName));
-    if (!hasMiddleware) {
-        throw new Error('You are calling `getUser` on a path that isn’t covered by the AuthKit middleware. Make sure it is running on all paths you are calling `getUser` from by updating your middleware config in `middleware.(js|ts)`.');
-    }
-    const session = await getSessionFromHeader();
+    const session = await getSessionFromHeader('getUser');
     if (!session) {
         if (ensureSignedIn) {
             const url = (0, headers_1.headers)().get('x-url');
@@ -125,6 +135,7 @@ async function getUser({ ensureSignedIn = false } = {}) {
         organizationId,
         role,
         impersonator: session.impersonator,
+        accessToken: session.accessToken,
     };
 }
 exports.getUser = getUser;
@@ -142,7 +153,6 @@ async function verifyAccessToken(accessToken) {
         return true;
     }
     catch (e) {
-        console.warn('Failed to verify session:', e);
         return false;
     }
 }
@@ -154,7 +164,11 @@ async function getSessionFromCookie() {
         });
     }
 }
-async function getSessionFromHeader() {
+async function getSessionFromHeader(caller) {
+    const hasMiddleware = Boolean((0, headers_1.headers)().get(middlewareHeaderName));
+    if (!hasMiddleware) {
+        throw new Error(`You are calling \`${caller}\` on a path that isn’t covered by the AuthKit middleware. Make sure it is running on all paths you are calling \`${caller}\` from by updating your middleware config in \`middleware.(js|ts)\`.`);
+    }
     const authHeader = (0, headers_1.headers)().get(sessionHeaderName);
     if (!authHeader)
         return;

package/dist/cjs/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;AAAA,gDAA2C;AAC3C,0CAAgD;AAChD,wCAAwD;AACxD,+BAAgE;AAChE,+CAAoD;AACpD,2CAAwD;AACxD,2CAAqC;AACrC,yDAAmG;AACnG,yEAAiE;AAGjE,mDAAuD;AAEvD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD,MAAM,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,kBAAM,CAAC,cAAc,CAAC,UAAU,CAAC,mCAAgB,CAAC,CAAC,CAAC,CAAC;AAE7F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,OAAO,IAAA,uBAAQ,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,yCAAsB,EAAE,CAAC,CAAC;AACjE,CAAC;AA0KQ,wCAAc;AAxKvB,KAAK,UAAU,aAAa,CAAC,OAAoB,EAAE,KAAc,EAAE,cAAqC;IACtG,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvD,0FAA0F;IAC1F,qGAAqG;IACrG,gFAAgF;IAChF,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,kGAAkG;IAClG,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAEpD,iBAAiB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE5C,MAAM,YAAY,GAAa,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrF,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAEvD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,4GAA4G;IAC5G,IAAI,cAAc,CAAC,OAAO,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpE,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC1F,OAAO,qBAAY,CAAC,QAAQ,CAAC,MAAM,IAAA,8CAAmB,EAAC,EAAE,cAAc,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,qBAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3C,wEAAwE;QACxE,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,sBAAU,CAAE,CAAC,KAAK,CAAC,CAAC;QAC3E,OAAO,qBAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAEpF,kHAAkH;QAClH,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAM,CAAC,cAAc,CAAC,4BAA4B,CAAC;YAC7F,QAAQ,EAAE,mCAAgB;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;QAE5D,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC;YAC5C,WAAW;YACX,YAAY;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,qBAAY,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;QACH,oBAAoB;QACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAU,EAAE,gBAAgB,EAAE,yBAAa,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,qBAAY,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;QACH,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAU,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAyFwB,sCAAa;AAvFtC,SAAS,0BAA0B,CAAC,QAAgB;IAClD,IAAI,KAAa,CAAC;IAElB,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,sCAAmB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAS,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAA,sBAAK,EAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAEtC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEjE,MAAM,IAAI,KAAK,CAAC,qDAAqD,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAMD,KAAK,UAAU,OAAO,CAAC,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,EAAE;IACpD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,mNAAmN,CACpN,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,IAAA,qBAAQ,EAAC,MAAM,IAAA,8CAAmB,EAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,IAAA,gBAAS,EAAc,OAAO,CAAC,WAAW,CAAC,CAAC;IAErG,OAAO;QACL,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc;QACd,IAAI;QACJ,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;AACJ,CAAC;AAoCuC,0BAAO;AAlC/C,KAAK,UAAU,gBAAgB;IAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IACtC,IAAI,SAAS,EAAE,CAAC;QACd,IAAA,qBAAQ,EAAC,kBAAM,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAA,qBAAQ,EAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AA4BgD,4CAAgB;AA1BjE,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAClD,IAAI,CAAC;QACH,MAAM,IAAA,gBAAS,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,MAAM,GAAG,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,sBAAU,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAA,yBAAU,EAAU,MAAM,CAAC,KAAK,EAAE;YACvC,QAAQ,EAAE,yCAAsB;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,UAAU,GAAG,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,OAAO,IAAA,yBAAU,EAAU,UAAU,EAAE,EAAE,QAAQ,EAAE,yCAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;AAAA,gDAA2C;AAC3C,0CAAgD;AAChD,wCAAwD;AACxD,+BAAgE;AAChE,+CAAoD;AACpD,2CAAwD;AACxD,2CAAqC;AACrC,yDAAmG;AACnG,yEAAiE;AAGjE,mDAAuD;AAEvD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD,MAAM,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,kBAAM,CAAC,cAAc,CAAC,UAAU,CAAC,mCAAgB,CAAC,CAAC,CAAC,CAAC;AAE7F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,OAAO,IAAA,uBAAQ,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,yCAAsB,EAAE,CAAC,CAAC;AACjE,CAAC;AA2LQ,wCAAc;AAzLvB,KAAK,UAAU,aAAa,CAAC,OAAoB,EAAE,KAAc,EAAE,cAAqC;IACtG,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvD,0FAA0F;IAC1F,qGAAqG;IACrG,gFAAgF;IAChF,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,kGAAkG;IAClG,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAEpD,iBAAiB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sCAAmB,CAAC,CAAC;IAEzC,IACE,cAAc,CAAC,OAAO;QACtB,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ;QACzC,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC3D,CAAC;QACD,qBAAqB;QACrB,qCAAqC;QACrC,kDAAkD;QAClD,6DAA6D;QAC7D,EAAE;QACF,mGAAmG;QACnG,4GAA4G;QAC5G,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,YAAY,GAAa,cAAc,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrF,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAEvD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,4GAA4G;IAC5G,IAAI,cAAc,CAAC,OAAO,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpE,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC1F,OAAO,qBAAY,CAAC,QAAQ,CAAC,MAAM,IAAA,8CAAmB,EAAC,EAAE,cAAc,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,qBAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3C,wEAAwE;QACxE,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,sBAAU,CAAE,CAAC,KAAK,CAAC,CAAC;QAC3E,OAAO,qBAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAEpF,kHAAkH;QAClH,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAM,CAAC,cAAc,CAAC,4BAA4B,CAAC;YAC7F,QAAQ,EAAE,mCAAgB;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;QAE5D,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC;YAC5C,WAAW;YACX,YAAY;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,qBAAY,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;QACH,oBAAoB;QACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAU,EAAE,gBAAgB,EAAE,yBAAa,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,qBAAY,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACxC,CAAC,CAAC;QACH,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAU,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAyFwB,sCAAa;AAvFtC,SAAS,0BAA0B,CAAC,QAAgB;IAClD,IAAI,KAAa,CAAC;IAElB,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,sCAAmB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAS,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAA,sBAAK,EAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAEtC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEjE,MAAM,IAAI,KAAK,CAAC,qDAAqD,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAMD,KAAK,UAAU,OAAO,CAAC,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,EAAE;IACpD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,IAAA,qBAAQ,EAAC,MAAM,IAAA,8CAAmB,EAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,IAAA,gBAAS,EAAc,OAAO,CAAC,WAAW,CAAC,CAAC;IAErG,OAAO;QACL,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc;QACd,IAAI;QACJ,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AA2CuC,0BAAO;AAzC/C,KAAK,UAAU,gBAAgB;IAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IACtC,IAAI,SAAS,EAAE,CAAC;QACd,IAAA,qBAAQ,EAAC,kBAAM,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAA,qBAAQ,EAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAmCgD,4CAAgB;AAjCjE,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAClD,IAAI,CAAC;QACH,MAAM,IAAA,gBAAS,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,MAAM,GAAG,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,sBAAU,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAA,yBAAU,EAAU,MAAM,CAAC,KAAK,EAAE;YACvC,QAAQ,EAAE,yCAAsB;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,qHAAqH,MAAM,uEAAuE,CAC9N,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,iBAAO,GAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,OAAO,IAAA,yBAAU,EAAU,UAAU,EAAE,EAAE,QAAQ,EAAE,yCAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/cjs/workos.js

@@ -4,7 +4,12 @@ exports.workos = void 0;
 const tslib_1 = require("tslib");
 const node_1 = tslib_1.__importDefault(require("@workos-inc/node"));
 const env_variables_js_1 = require("./env-variables.js");
+const options = {
+    apiHostname: env_variables_js_1.WORKOS_API_HOSTNAME,
+    https: env_variables_js_1.WORKOS_API_HTTPS ? env_variables_js_1.WORKOS_API_HTTPS === 'true' : true,
+    port: env_variables_js_1.WORKOS_API_PORT ? parseInt(env_variables_js_1.WORKOS_API_PORT) : undefined,
+};
 // Initialize the WorkOS client
-const workos = new node_1.default(env_variables_js_1.WORKOS_API_KEY);
+const workos = new node_1.default(env_variables_js_1.WORKOS_API_KEY, options);
 exports.workos = workos;
 //# sourceMappingURL=workos.js.map

package/dist/cjs/workos.js.map

@@ -1 +1 @@
-{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/workos.ts"],"names":[],"mappings":";;;;AAAA,oEAAsC;AACtC,yDAAoD;AAEpD,+BAA+B;AAC/B,MAAM,MAAM,GAAG,IAAI,cAAM,CAAC,iCAAc,CAAC,CAAC;AAEjC,wBAAM"}
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/workos.ts"],"names":[],"mappings":";;;;AAAA,oEAAsC;AACtC,yDAA4G;AAG5G,MAAM,OAAO,GAAG;IACd,WAAW,EAAE,sCAAmB;IAChC,KAAK,EAAE,mCAAgB,CAAC,CAAC,CAAC,mCAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI;IAC5D,IAAI,EAAE,kCAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAe,CAAC,CAAC,CAAC,CAAC,SAAS;CAC9D,CAAC;AAEF,+BAA+B;AAC/B,MAAM,MAAM,GAAG,IAAI,cAAM,CAAC,iCAAc,EAAE,OAAO,CAAC,CAAC;AAE1C,wBAAM"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos-inc/authkit-nextjs",
-  "version": "0.5.3",
+  "version": "0.6.2",
   "description": "Authentication and session helpers for using WorkOS & AuthKit with Next.js",
   "sideEffects": false,
   "type": "commonjs",

package/src/cookie.ts

@@ -1,4 +1,4 @@
-import { WORKOS_REDIRECT_URI } from './env-variables.js';
+import { WORKOS_REDIRECT_URI, WORKOS_COOKIE_MAX_AGE } from './env-variables.js';
 
 const redirectUrl = new URL(WORKOS_REDIRECT_URI);
 const isSecureProtocol = redirectUrl.protocol === 'https:';
@@ -9,6 +9,10 @@ const cookieOptions = {
   httpOnly: true,
   secure: isSecureProtocol,
   sameSite: 'lax' as const,
+  // Defaults to 400 days, the maximum allowed by Chrome
+  // It's fine to have a long cookie expiry date as the access/refresh tokens
+  // act as the actual time-limited aspects of the session.
+  maxAge: WORKOS_COOKIE_MAX_AGE ? parseInt(WORKOS_COOKIE_MAX_AGE, 10) : 60 * 60 * 24 * 400,
 };
 
 export { cookieName, cookieOptions };

package/src/env-variables.ts

@@ -1,4 +1,4 @@
-function getEnvVariable(name: string) {
+function getEnvVariable(name: string): string {
   const envVariable = process.env[name];
   if (!envVariable) {
     throw new Error(`${name} environment variable is not set`);
@@ -6,13 +6,30 @@ function getEnvVariable(name: string) {
   return envVariable;
 }
 
+function getOptionalEnvVariable(name: string): string | undefined {
+  return process.env[name];
+}
+
 const WORKOS_CLIENT_ID = getEnvVariable('WORKOS_CLIENT_ID');
 const WORKOS_API_KEY = getEnvVariable('WORKOS_API_KEY');
 const WORKOS_REDIRECT_URI = getEnvVariable('WORKOS_REDIRECT_URI');
 const WORKOS_COOKIE_PASSWORD = getEnvVariable('WORKOS_COOKIE_PASSWORD');
+const WORKOS_API_HOSTNAME = getOptionalEnvVariable('WORKOS_API_HOSTNAME');
+const WORKOS_API_HTTPS = getOptionalEnvVariable('WORKOS_API_HTTPS');
+const WORKOS_API_PORT = getOptionalEnvVariable('WORKOS_API_PORT');
+const WORKOS_COOKIE_MAX_AGE = getOptionalEnvVariable('WORKOS_COOKIE_MAX_AGE');
 
 if (WORKOS_COOKIE_PASSWORD.length < 32) {
   throw new Error('WORKOS_COOKIE_PASSWORD must be at least 32 characters long');
 }
 
-export { WORKOS_CLIENT_ID, WORKOS_API_KEY, WORKOS_REDIRECT_URI, WORKOS_COOKIE_PASSWORD };
+export {
+  WORKOS_CLIENT_ID,
+  WORKOS_API_KEY,
+  WORKOS_REDIRECT_URI,
+  WORKOS_COOKIE_PASSWORD,
+  WORKOS_API_HOSTNAME,
+  WORKOS_API_HTTPS,
+  WORKOS_API_PORT,
+  WORKOS_COOKIE_MAX_AGE,
+};

package/src/interfaces.ts

@@ -21,6 +21,7 @@ export interface UserInfo {
   organizationId?: string;
   role?: string;
   impersonator?: Impersonator;
+  accessToken: string;
 }
 export interface NoUserInfo {
   user: null;
@@ -28,6 +29,7 @@ export interface NoUserInfo {
   organizationId?: undefined;
   role?: undefined;
   impersonator?: undefined;
+  accessToken?: undefined;
 }
 
 export interface AccessToken {

package/src/session.ts

@@ -34,6 +34,23 @@ async function updateSession(request: NextRequest, debug: boolean, middlewareAut
 
   newRequestHeaders.delete(sessionHeaderName);
 
+  const url = new URL(WORKOS_REDIRECT_URI);
+
+  if (
+    middlewareAuth.enabled &&
+    url.pathname === request.nextUrl.pathname &&
+    !middlewareAuth.unauthenticatedPaths.includes(url.pathname)
+  ) {
+    // In the case where:
+    // - We're using middleware auth mode
+    // - The redirect URI is in the middleware matcher
+    // - The redirect URI isn't in the unauthenticatedPaths array
+    //
+    // then we would get stuck in a login loop due to the redirect happening before the session is set.
+    // It's likely that the user accidentally forgot to add the path to unauthenticatedPaths, so we add it here.
+    middlewareAuth.unauthenticatedPaths.push(url.pathname);
+  }
+
   const matchedPaths: string[] = middlewareAuth.unauthenticatedPaths.filter((pathGlob) => {
     const pathRegex = getMiddlewareAuthPathRegex(pathGlob);
 
@@ -92,7 +109,7 @@ async function updateSession(request: NextRequest, debug: boolean, middlewareAut
     response.cookies.set(cookieName, encryptedSession, cookieOptions);
     return response;
   } catch (e) {
-    console.warn('Failed to refresh', e);
+    if (debug) console.log('Failed to refresh. Deleting cookie and redirecting.', e);
     const response = NextResponse.next({
       request: { headers: newRequestHeaders },
     });
@@ -125,15 +142,7 @@ async function getUser(options?: { ensureSignedIn: false }): Promise<UserInfo |
 async function getUser(options: { ensureSignedIn: true }): Promise<UserInfo>;
 
 async function getUser({ ensureSignedIn = false } = {}) {
-  const hasMiddleware = Boolean(headers().get(middlewareHeaderName));
-
-  if (!hasMiddleware) {
-    throw new Error(
-      'You are calling `getUser` on a path that isn’t covered by the AuthKit middleware. Make sure it is running on all paths you are calling `getUser` from by updating your middleware config in `middleware.(js|ts)`.',
-    );
-  }
-
-  const session = await getSessionFromHeader();
+  const session = await getSessionFromHeader('getUser');
   if (!session) {
     if (ensureSignedIn) {
       const url = headers().get('x-url');
@@ -151,6 +160,7 @@ async function getUser({ ensureSignedIn = false } = {}) {
     organizationId,
     role,
     impersonator: session.impersonator,
+    accessToken: session.accessToken,
   };
 }
 
@@ -167,7 +177,6 @@ async function verifyAccessToken(accessToken: string) {
     await jwtVerify(accessToken, JWKS);
     return true;
   } catch (e) {
-    console.warn('Failed to verify session:', e);
     return false;
   }
 }
@@ -181,7 +190,15 @@ async function getSessionFromCookie() {
   }
 }
 
-async function getSessionFromHeader(): Promise<Session | undefined> {
+async function getSessionFromHeader(caller: string): Promise<Session | undefined> {
+  const hasMiddleware = Boolean(headers().get(middlewareHeaderName));
+
+  if (!hasMiddleware) {
+    throw new Error(
+      `You are calling \`${caller}\` on a path that isn’t covered by the AuthKit middleware. Make sure it is running on all paths you are calling \`${caller}\` from by updating your middleware config in \`middleware.(js|ts)\`.`,
+    );
+  }
+
   const authHeader = headers().get(sessionHeaderName);
   if (!authHeader) return;
 

package/src/workos.ts

@@ -1,7 +1,14 @@
 import WorkOS from '@workos-inc/node';
-import { WORKOS_API_KEY } from './env-variables.js';
+import { WORKOS_API_HOSTNAME, WORKOS_API_HTTPS, WORKOS_API_KEY, WORKOS_API_PORT } from './env-variables.js';
+
+
+const options = {
+  apiHostname: WORKOS_API_HOSTNAME,
+  https: WORKOS_API_HTTPS ? WORKOS_API_HTTPS === 'true' : true,
+  port: WORKOS_API_PORT ? parseInt(WORKOS_API_PORT) : undefined,
+};
 
 // Initialize the WorkOS client
-const workos = new WorkOS(WORKOS_API_KEY);
+const workos = new WorkOS(WORKOS_API_KEY, options);
 
 export { workos };