router-core/auth-and-guards

Implement route protection in TanStack Router using beforeLoad guards to verify auth state and redirect unauthenticated users. You can wrap secured pages in an _authenticated layout route to centrally enforce access control.

RBAC integration in TanStack Router guards works by checking user roles and permissions within the beforeLoad hook, blocking or redirecting access when permissions are insufficient. This secures specific routes like admin dashboards based on assigned roles.

Yes, you can integrate auth providers like Clerk, Auth0, and Supabase with TanStack Router guards. The implementation connects your live auth context to the router context, allowing beforeLoad hooks to read provider state and enforce access.

The best way to redirect unauthenticated users in TanStack Router is using the redirect() or throw redirect() functions within the beforeLoad guard. The isRedirect helper can then catch and manage these redirect flows appropriately.

No, an _authenticated layout route is not strictly required, but it is recommended for grouping protected pages. You can also use non-redirect auth or inline login patterns to guard individual routes without a dedicated layout.