api-route-conventions

Use the getAuthOrTest pattern to authenticate requests consistently across your Next.js API routes. This approach validates user identity before processing, supporting bypass methods for development and webhook verification scenarios.

Implement standardized error handling by returning consistent response formats with appropriate HTTP status codes, structured logging, and clear error messages. The standard template covers common failure modes across GET, POST, and webhook routes.

Webhook verification requires validating signatures and timestamps from each provider using their libraries and secrets. The Skill provides verified patterns for Stripe, Clerk, and QStash webhook routes at /app/api/webhooks/[provider]/route.ts.

Yes, use Zod schemas to validate incoming GET and POST data with structured parsing. Apply validation before authentication and business logic to ensure type safety and consistent error responses across all endpoints.

Rate limiting protects endpoints from abuse and ensures fair resource allocation. The Skill includes standard rate-limiting patterns integrated into the API route template, particularly important for public webhooks and user-facing endpoints.

Migrate routes to the /app/api/[feature]/route.ts structure following the standard template patterns. This organization ensures consistency, reduces security risks from ad-hoc endpoint creation, and simplifies debugging and logging across your API surface.