@workos-inc/authkit-nextjs 2.16.0 → 2.16.1

package/dist/esm/env-variables.js

@@ -11,11 +11,11 @@ const WORKOS_COOKIE_DOMAIN = getEnvVariable('WORKOS_COOKIE_DOMAIN');
 const WORKOS_COOKIE_MAX_AGE = getEnvVariable('WORKOS_COOKIE_MAX_AGE');
 const WORKOS_COOKIE_NAME = getEnvVariable('WORKOS_COOKIE_NAME');
 const WORKOS_COOKIE_SAMESITE = getEnvVariable('WORKOS_COOKIE_SAMESITE');
-const WORKOS_DISABLE_PKCE = getEnvVariable('WORKOS_DISABLE_PKCE');
+const WORKOS_ENABLE_PKCE = getEnvVariable('WORKOS_ENABLE_PKCE');
 // Required env variables
 const WORKOS_API_KEY = (_a = getEnvVariable('WORKOS_API_KEY')) !== null && _a !== void 0 ? _a : '';
 const WORKOS_CLIENT_ID = (_b = getEnvVariable('WORKOS_CLIENT_ID')) !== null && _b !== void 0 ? _b : '';
 const WORKOS_COOKIE_PASSWORD = (_c = getEnvVariable('WORKOS_COOKIE_PASSWORD')) !== null && _c !== void 0 ? _c : '';
 const WORKOS_REDIRECT_URI = (_d = process.env.NEXT_PUBLIC_WORKOS_REDIRECT_URI) !== null && _d !== void 0 ? _d : '';
-export { WORKOS_API_HOSTNAME, WORKOS_API_HTTPS, WORKOS_API_KEY, WORKOS_API_PORT, WORKOS_CLIENT_ID, WORKOS_COOKIE_DOMAIN, WORKOS_COOKIE_MAX_AGE, WORKOS_COOKIE_NAME, WORKOS_COOKIE_PASSWORD, WORKOS_REDIRECT_URI, WORKOS_COOKIE_SAMESITE, WORKOS_DISABLE_PKCE, };
+export { WORKOS_API_HOSTNAME, WORKOS_API_HTTPS, WORKOS_API_KEY, WORKOS_API_PORT, WORKOS_CLIENT_ID, WORKOS_COOKIE_DOMAIN, WORKOS_COOKIE_MAX_AGE, WORKOS_COOKIE_NAME, WORKOS_COOKIE_PASSWORD, WORKOS_REDIRECT_URI, WORKOS_COOKIE_SAMESITE, WORKOS_ENABLE_PKCE, };
 //# sourceMappingURL=env-variables.js.map

package/dist/esm/env-variables.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-variables.js","sourceRoot":"","sources":["../../src/env-variables.ts"],"names":[],"mappings":"AAAA,0BAA0B;;AAE1B,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,yBAAyB;AACzB,MAAM,mBAAmB,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAClE,MAAM,gBAAgB,GAAG,cAAc,CAAC,kBAAkB,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,cAAc,CAAC,sBAAsB,CAAC,CAAC;AACpE,MAAM,qBAAqB,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAAC;AACtE,MAAM,kBAAkB,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;AAChE,MAAM,sBAAsB,GAAG,cAAc,CAAC,wBAAwB,CAA0C,CAAC;AACjH,MAAM,mBAAmB,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAElE,yBAAyB;AACzB,MAAM,cAAc,GAAG,MAAA,cAAc,CAAC,gBAAgB,CAAC,mCAAI,EAAE,CAAC;AAC9D,MAAM,gBAAgB,GAAG,MAAA,cAAc,CAAC,kBAAkB,CAAC,mCAAI,EAAE,CAAC;AAClE,MAAM,sBAAsB,GAAG,MAAA,cAAc,CAAC,wBAAwB,CAAC,mCAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,+BAA+B,mCAAI,EAAE,CAAC;AAE9E,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,CAAC"}
+{"version":3,"file":"env-variables.js","sourceRoot":"","sources":["../../src/env-variables.ts"],"names":[],"mappings":"AAAA,0BAA0B;;AAE1B,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,yBAAyB;AACzB,MAAM,mBAAmB,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAClE,MAAM,gBAAgB,GAAG,cAAc,CAAC,kBAAkB,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,cAAc,CAAC,sBAAsB,CAAC,CAAC;AACpE,MAAM,qBAAqB,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAAC;AACtE,MAAM,kBAAkB,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;AAChE,MAAM,sBAAsB,GAAG,cAAc,CAAC,wBAAwB,CAA0C,CAAC;AACjH,MAAM,kBAAkB,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;AAEhE,yBAAyB;AACzB,MAAM,cAAc,GAAG,MAAA,cAAc,CAAC,gBAAgB,CAAC,mCAAI,EAAE,CAAC;AAC9D,MAAM,gBAAgB,GAAG,MAAA,cAAc,CAAC,kBAAkB,CAAC,mCAAI,EAAE,CAAC;AAClE,MAAM,sBAAsB,GAAG,MAAA,cAAc,CAAC,wBAAwB,CAAC,mCAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,+BAA+B,mCAAI,EAAE,CAAC;AAE9E,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,GACnB,CAAC"}

package/dist/esm/get-authorization-url.js

@@ -1,6 +1,6 @@
 import { sealData } from 'iron-session';
 import { headers } from 'next/headers';
-import { WORKOS_CLIENT_ID, WORKOS_COOKIE_PASSWORD, WORKOS_DISABLE_PKCE, WORKOS_REDIRECT_URI } from './env-variables.js';
+import { WORKOS_CLIENT_ID, WORKOS_COOKIE_PASSWORD, WORKOS_ENABLE_PKCE, WORKOS_REDIRECT_URI } from './env-variables.js';
 import { getWorkOS } from './workos.js';
 async function getAuthorizationUrl(options = {}) {
     var _a;
@@ -24,17 +24,17 @@ async function getAuthorizationUrl(options = {}) {
         loginHint,
         prompt,
     };
-    if (WORKOS_DISABLE_PKCE === 'true') {
-        return { url: getWorkOS().userManagement.getAuthorizationUrl(baseOptions), pkceCookieValue: undefined };
+    if (WORKOS_ENABLE_PKCE === 'true') {
+        const pkce = await getWorkOS().pkce.generate();
+        const pkceCookieValue = await sealData({ codeVerifier: pkce.codeVerifier }, { password: WORKOS_COOKIE_PASSWORD, ttl: 600 });
+        const url = getWorkOS().userManagement.getAuthorizationUrl({
+            ...baseOptions,
+            codeChallenge: pkce.codeChallenge,
+            codeChallengeMethod: pkce.codeChallengeMethod,
+        });
+        return { url, pkceCookieValue };
     }
-    const pkce = await getWorkOS().pkce.generate();
-    const pkceCookieValue = await sealData({ codeVerifier: pkce.codeVerifier }, { password: WORKOS_COOKIE_PASSWORD, ttl: 600 });
-    const url = getWorkOS().userManagement.getAuthorizationUrl({
-        ...baseOptions,
-        codeChallenge: pkce.codeChallenge,
-        codeChallengeMethod: pkce.codeChallengeMethod,
-    });
-    return { url, pkceCookieValue };
+    return { url: getWorkOS().userManagement.getAuthorizationUrl(baseOptions), pkceCookieValue: undefined };
 }
 export { getAuthorizationUrl };
 //# sourceMappingURL=get-authorization-url.js.map

package/dist/esm/get-authorization-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-authorization-url.js","sourceRoot":"","sources":["../../src/get-authorization-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAExH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,KAAK,UAAU,mBAAmB,CAAC,UAA6B,EAAE;;IAChE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACtG,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,WAAW,GAAG,MAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,mCAAI,SAAS,CAAC;IAC/D,CAAC;IAED,MAAM,aAAa,GAAG,cAAc;QAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QAClF,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,UAAU,GACd,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,WAAW,IAAI,SAAS,CAAC;IAE/G,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,SAAkB;QAC5B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,mBAAmB;QAC/C,KAAK,EAAE,UAAU;QACjB,UAAU;QACV,cAAc;QACd,SAAS;QACT,MAAM;KACP,CAAC;IAEF,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;IAC1G,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,MAAM,QAAQ,CACpC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACnC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAC/C,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC;QACzD,GAAG,WAAW;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"get-authorization-url.js","sourceRoot":"","sources":["../../src/get-authorization-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEvH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,KAAK,UAAU,mBAAmB,CAAC,UAA6B,EAAE;;IAChE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACtG,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,WAAW,GAAG,MAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,mCAAI,SAAS,CAAC;IAC/D,CAAC;IAED,MAAM,aAAa,GAAG,cAAc;QAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QAClF,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,UAAU,GACd,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,WAAW,IAAI,SAAS,CAAC;IAE/G,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,SAAkB;QAC5B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,mBAAmB;QAC/C,KAAK,EAAE,UAAU;QACjB,UAAU;QACV,cAAc;QACd,SAAS;QACT,MAAM;KACP,CAAC;IAEF,IAAI,kBAAkB,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,eAAe,GAAG,MAAM,QAAQ,CACpC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EACnC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAC/C,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC;YACzD,GAAG,WAAW;YACd,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAC1G,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/esm/types/env-variables.d.ts

@@ -5,9 +5,9 @@ declare const WORKOS_COOKIE_DOMAIN: string | undefined;
 declare const WORKOS_COOKIE_MAX_AGE: string | undefined;
 declare const WORKOS_COOKIE_NAME: string | undefined;
 declare const WORKOS_COOKIE_SAMESITE: "lax" | "strict" | "none" | undefined;
-declare const WORKOS_DISABLE_PKCE: string | undefined;
+declare const WORKOS_ENABLE_PKCE: string | undefined;
 declare const WORKOS_API_KEY: string;
 declare const WORKOS_CLIENT_ID: string;
 declare const WORKOS_COOKIE_PASSWORD: string;
 declare const WORKOS_REDIRECT_URI: string;
-export { WORKOS_API_HOSTNAME, WORKOS_API_HTTPS, WORKOS_API_KEY, WORKOS_API_PORT, WORKOS_CLIENT_ID, WORKOS_COOKIE_DOMAIN, WORKOS_COOKIE_MAX_AGE, WORKOS_COOKIE_NAME, WORKOS_COOKIE_PASSWORD, WORKOS_REDIRECT_URI, WORKOS_COOKIE_SAMESITE, WORKOS_DISABLE_PKCE, };
+export { WORKOS_API_HOSTNAME, WORKOS_API_HTTPS, WORKOS_API_KEY, WORKOS_API_PORT, WORKOS_CLIENT_ID, WORKOS_COOKIE_DOMAIN, WORKOS_COOKIE_MAX_AGE, WORKOS_COOKIE_NAME, WORKOS_COOKIE_PASSWORD, WORKOS_REDIRECT_URI, WORKOS_COOKIE_SAMESITE, WORKOS_ENABLE_PKCE, };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos-inc/authkit-nextjs",
-  "version": "2.16.0",
+  "version": "2.16.1",
   "description": "Authentication and session helpers for using WorkOS & AuthKit with Next.js",
   "sideEffects": false,
   "type": "module",

package/src/env-variables.ts

@@ -12,7 +12,7 @@ const WORKOS_COOKIE_DOMAIN = getEnvVariable('WORKOS_COOKIE_DOMAIN');
 const WORKOS_COOKIE_MAX_AGE = getEnvVariable('WORKOS_COOKIE_MAX_AGE');
 const WORKOS_COOKIE_NAME = getEnvVariable('WORKOS_COOKIE_NAME');
 const WORKOS_COOKIE_SAMESITE = getEnvVariable('WORKOS_COOKIE_SAMESITE') as 'lax' | 'strict' | 'none' | undefined;
-const WORKOS_DISABLE_PKCE = getEnvVariable('WORKOS_DISABLE_PKCE');
+const WORKOS_ENABLE_PKCE = getEnvVariable('WORKOS_ENABLE_PKCE');
 
 // Required env variables
 const WORKOS_API_KEY = getEnvVariable('WORKOS_API_KEY') ?? '';
@@ -32,5 +32,5 @@ export {
   WORKOS_COOKIE_PASSWORD,
   WORKOS_REDIRECT_URI,
   WORKOS_COOKIE_SAMESITE,
-  WORKOS_DISABLE_PKCE,
+  WORKOS_ENABLE_PKCE,
 };

package/src/get-authorization-url.spec.ts

@@ -26,7 +26,7 @@ describe('getAuthorizationUrl', () => {
   const workos = getWorkOS();
   beforeEach(() => {
     vi.clearAllMocks();
-    delete process.env.WORKOS_DISABLE_PKCE;
+    delete process.env.WORKOS_ENABLE_PKCE;
     fakeWorkosInstance.pkce.generate.mockResolvedValue({
       codeVerifier: 'test-code-verifier',
       codeChallenge: 'test-code-challenge',
@@ -71,11 +71,31 @@ describe('getAuthorizationUrl', () => {
   });
 
   describe('PKCE', () => {
-    it('generates PKCE pair and includes codeChallenge in authorization URL', async () => {
+    it('skips PKCE by default', async () => {
       vi.mocked(workos.userManagement.getAuthorizationUrl).mockReturnValue('mock-url');
 
       const result = await getAuthorizationUrl({});
 
+      expect(fakeWorkosInstance.pkce.generate).not.toHaveBeenCalled();
+      expect(workos.userManagement.getAuthorizationUrl).toHaveBeenCalledWith(
+        expect.not.objectContaining({
+          codeChallenge: expect.any(String),
+        }),
+      );
+      expect(result.pkceCookieValue).toBeUndefined();
+    });
+
+    it('generates PKCE pair when WORKOS_ENABLE_PKCE is set to true', async () => {
+      process.env.WORKOS_ENABLE_PKCE = 'true';
+
+      // Re-import to pick up the new env var
+      vi.resetModules();
+      const { getAuthorizationUrl: freshGetAuthorizationUrl } = await import('./get-authorization-url.js');
+
+      vi.mocked(workos.userManagement.getAuthorizationUrl).mockReturnValue('mock-url');
+
+      const result = await freshGetAuthorizationUrl({});
+
       expect(fakeWorkosInstance.pkce.generate).toHaveBeenCalled();
       expect(workos.userManagement.getAuthorizationUrl).toHaveBeenCalledWith(
         expect.objectContaining({
@@ -88,20 +108,9 @@ describe('getAuthorizationUrl', () => {
       expect(result.pkceCookieValue).not.toBe('');
     });
 
-    it('returns sealed cookie value for the verifier', async () => {
-      vi.mocked(workos.userManagement.getAuthorizationUrl).mockReturnValue('mock-url');
-
-      const result = await getAuthorizationUrl({});
-
-      // pkceCookieValue should be a sealed (encrypted) string
-      expect(typeof result.pkceCookieValue).toBe('string');
-      expect(result.pkceCookieValue!.length).toBeGreaterThan(0);
-    });
-
-    it('skips PKCE when WORKOS_DISABLE_PKCE is set to true', async () => {
-      process.env.WORKOS_DISABLE_PKCE = 'true';
+    it('returns sealed cookie value for the verifier when PKCE is enabled', async () => {
+      process.env.WORKOS_ENABLE_PKCE = 'true';
 
-      // Re-import to pick up the new env var
       vi.resetModules();
       const { getAuthorizationUrl: freshGetAuthorizationUrl } = await import('./get-authorization-url.js');
 
@@ -109,13 +118,9 @@ describe('getAuthorizationUrl', () => {
 
       const result = await freshGetAuthorizationUrl({});
 
-      expect(fakeWorkosInstance.pkce.generate).not.toHaveBeenCalled();
-      expect(workos.userManagement.getAuthorizationUrl).toHaveBeenCalledWith(
-        expect.not.objectContaining({
-          codeChallenge: expect.any(String),
-        }),
-      );
-      expect(result.pkceCookieValue).toBeUndefined();
+      // pkceCookieValue should be a sealed (encrypted) string
+      expect(typeof result.pkceCookieValue).toBe('string');
+      expect(result.pkceCookieValue!.length).toBeGreaterThan(0);
     });
   });
 });

package/src/get-authorization-url.ts

@@ -1,6 +1,6 @@
 import { sealData } from 'iron-session';
 import { headers } from 'next/headers';
-import { WORKOS_CLIENT_ID, WORKOS_COOKIE_PASSWORD, WORKOS_DISABLE_PKCE, WORKOS_REDIRECT_URI } from './env-variables.js';
+import { WORKOS_CLIENT_ID, WORKOS_COOKIE_PASSWORD, WORKOS_ENABLE_PKCE, WORKOS_REDIRECT_URI } from './env-variables.js';
 import { GetAuthURLOptions, GetAuthURLResult } from './interfaces.js';
 import { getWorkOS } from './workos.js';
 
@@ -30,22 +30,22 @@ async function getAuthorizationUrl(options: GetAuthURLOptions = {}): Promise<Get
     prompt,
   };
 
-  if (WORKOS_DISABLE_PKCE === 'true') {
-    return { url: getWorkOS().userManagement.getAuthorizationUrl(baseOptions), pkceCookieValue: undefined };
+  if (WORKOS_ENABLE_PKCE === 'true') {
+    const pkce = await getWorkOS().pkce.generate();
+    const pkceCookieValue = await sealData(
+      { codeVerifier: pkce.codeVerifier },
+      { password: WORKOS_COOKIE_PASSWORD, ttl: 600 },
+    );
+    const url = getWorkOS().userManagement.getAuthorizationUrl({
+      ...baseOptions,
+      codeChallenge: pkce.codeChallenge,
+      codeChallengeMethod: pkce.codeChallengeMethod,
+    });
+
+    return { url, pkceCookieValue };
   }
 
-  const pkce = await getWorkOS().pkce.generate();
-  const pkceCookieValue = await sealData(
-    { codeVerifier: pkce.codeVerifier },
-    { password: WORKOS_COOKIE_PASSWORD, ttl: 600 },
-  );
-  const url = getWorkOS().userManagement.getAuthorizationUrl({
-    ...baseOptions,
-    codeChallenge: pkce.codeChallenge,
-    codeChallengeMethod: pkce.codeChallengeMethod,
-  });
-
-  return { url, pkceCookieValue };
+  return { url: getWorkOS().userManagement.getAuthorizationUrl(baseOptions), pkceCookieValue: undefined };
 }
 
 export { getAuthorizationUrl };