@inlayai/next
Next.js session minting — the server route and its browser provider.
Session minting for Next.js: a secret key lives server-side; the browser only ever holds short-lived session JWTs. Two halves that can't drift — the client provider POSTs exactly the route this package builds.
Server (@inlayai/next)
The server entry imports server-only — it cannot be bundled client-side.
createSessionRoute
createSessionRoute(config): (req: Request) => Promise<Response>
Builds an App Router POST handler that mints a session. Mount at
app/api/inlay/session/route.ts:
import { createSessionRoute } from "@inlayai/next";
export const POST = createSessionRoute({ userId: () => "user-123" });The fixed user ID above only illustrates the signature. Before serving real
users, replace the resolver with your own server-verified authentication and
return null when the request is unauthenticated. A shared ID would share
conversation history and durable user state. Configure the server-only
INLAY_SECRET_KEY; use INLAY_API_URL for a non-production deployment.
See Quickstart.
Responses: 200 Session JSON · 401 (userId returned null or threw
UnauthorizedError — a sign-in wall, not an error page) · 500 (missing
config) · 502 (a genuine upstream failure).
SessionRouteConfig
Prop
Type
mintSession
mintSession(opts): Promise<Session> — the direct mint (POST /v1/sessions
with the secret key), for route handlers or server actions of your own.
Validates the response: a 200 missing any session field throws (a malformed
body must never become a Bearer undefined credential).
MintSessionOptions
Prop
Type
UnauthorizedError
Throw from a userId resolver to decline with a 401 instead of a 502 — the
distinction a client fetcher needs to show a sign-in wall rather than an
error page. Any other throw still maps to 502.
Browser (@inlayai/next/client)
createSessionProvider
createSessionProvider(path?, fetchImpl?): SessionProvider
The browser half: a session provider that POSTs your route (default
/api/inlay/session) and returns the minted Session. Token caching and
401-refresh stay the transport's job; this fetcher stays dumb on purpose,
with one exception — concurrent 401 refreshes share ONE in-flight mint, so
N dying streams produce one POST, not N.
import { createSessionProvider } from "@inlayai/next/client";
const session = createSessionProvider();
useInlayChat({ session, /* … */ }); // baseUrl optional — production by default