intermediate

API surface

Route handlers, backend-for-frontend boundaries, and authentication integration inside a Next.js app.

Next.js apps expose HTTP through route handlers, Server Actions, and sometimes legacy Pages API routes. The API surface should match ownership: UI-specific aggregation belongs near the frontend; domain services stay behind clear boundaries.

Subtopics: route handlers, BFF pattern, and authentication integration across middleware, handlers, and server components.

On interviews: decide when a route handler beats an external API gateway and how auth propagates.

Common pitfalls: exposing raw database access to the browser, duplicating every backend endpoint, and inconsistent auth between middleware and handlers.

Checklist:

Route handlers for HTTP contracts.
BFF for UI-shaped aggregation.
Centralize session verification.
Validate all external input.