Production Essentials

Set up a production auth stack for a Next.js 15 app. Use Auth.js (NextAuth) with Google + GitHub OAuth providers plus an email magic-link provider via Resend. Store sessions as HTTP-only cookies. Provide a middleware that gates /app routes and redirects unauthenticated users to /login. Build a useSession hook for client components and a getSession helper for server components. Add a basic RBAC check (user.role === 'admin') with a typed helper.

Wire up Stripe subscriptions in a Next.js app. Create products + prices in Stripe Dashboard. Implement /api/checkout that creates a Checkout Session and redirects. Implement /api/webhook that verifies the Stripe signature and updates a local subscriptions table on customer.subscription.created/updated/deleted and invoice.payment_succeeded. Add a /api/portal endpoint that returns a Customer Portal URL. Cache subscription state on the user row and gate /pro routes via a middleware helper hasProAccess(userId).

Set up observability for a Next.js app. Install @sentry/nextjs with auto-instrumentation for App Router and edge runtime; mask PII; capture release tags from git SHA. Pipe structured logs (pino with redact for secrets) to Axiom via their Vercel integration. Add PostHog with autocapture disabled and explicit posthog.capture() events for key product moments. Add a /status route consuming Instatus's component-status API.

Set up transactional email with Resend. Configure SPF, DKIM, DMARC on the sending domain. Build three React Email templates: magic-link, receipt, password-changed. Create a sendEmail() helper that takes a template + props, attaches an idempotency key derived from the user + event, and queues sends through a single transactional stream. Add a separate marketing stream for any opt-in broadcast email so transactional reputation is never poisoned.

Set up the database layer for a Next.js app. Provision Postgres (Neon for serverless or Supabase if you also need auth/realtime). Use Drizzle ORM with TypeScript-first schema definitions. Migrations live in /drizzle and run via 'drizzle-kit migrate' in CI before deploy. Wrap Postgres queries with a typed db client; for tenanted data, enforce row-level security via session-variable-based policies. Add Postgres connection pooling and use the unpooled URL only for migrations.

Wire up a file storage stack. Use Cloudflare R2 (or Vercel Blob) for primary storage. Build a presigned-URL endpoint at /api/upload-url that returns a short-lived signed PUT URL after validating user permissions, max file size, and accepted MIME types. The client uploads directly to storage. No server proxying. Persist a file record in the DB with key, owner, size, content-type. For image delivery, use Next.js Image with a remote pattern pointing at the CDN that supports on-the-fly resize + format conversion.

Set up search for a product. Use Algolia or Typesense. On every write to the indexed entities (Issue, Doc, User), enqueue an indexer job that pushes the latest record to the search index. Build a /api/search endpoint that proxies queries with a per-tenant API key (never expose admin keys to the browser). On the client, render a typeahead component that debounces 120ms and shows grouped results. Configure synonyms, stop-words, and a custom ranking that weights recent and owner-authored records higher.

Wire up background jobs with Inngest (or Trigger.dev). Define jobs as TypeScript functions with explicit retry policies and timeouts. Trigger from API routes via inngest.send(). Make every handler idempotent. Derive an idempotency key from the event + entity ID and short-circuit if already processed. For periodic work, use cron-triggered functions. Pipe failed jobs (after max retries) to a dead-letter table with an alert via the observability stack.

Set up feature flags with PostHog or GrowthBook. Server-side: evaluate flags in route handlers with the user ID + plan + geo as context; cache evaluations per request to avoid hammering the service. Client-side: ship the hydrated flag snapshot down with the SSR response so the first render doesn't flicker. Implement a flag-changed audit log: every flag toggle from the admin UI writes a record with who/when/what. Use kill-switch flags around risky features so you can disable a path without a deploy.

Set up rate limiting in a Next.js API. Use @upstash/ratelimit with a Redis backend. Create a limiter factory that returns a configured limiter per endpoint (e.g. auth: 5/min, /api/checkout: 20/min, public reads: 60/min). In each route handler, identify the actor (userId > apiKey > ip), call limit(identifier), and on rejection return a 429 with Retry-After + a JSON body explaining the limit. Add an internal allowlist (e.g. internal cron user IDs) that bypasses the limiter.