tRPC

Create a router with initTRPC, expose it through a fetchRequestHandler route at app/api/trpc/[trpc]/route.ts, then wrap your app in a provider combining the tRPC client and React Query's QueryClientProvider. Components call procedures via typed hooks like trpc.user.list.useQuery().

Create middleware with t.middleware that checks ctx.session and throws a TRPCError with code UNAUTHORIZED when missing. Chain it onto a procedure to create a protectedProcedure, which also narrows the context type so session is non-nullable downstream.

No. tRPC infers types directly from your server router definition. Exporting the AppRouter type and importing it on the client gives full autocomplete and compile-time safety without any codegen step.

Pass a Zod schema to the .input() method of a procedure. Invalid input is rejected before your handler runs, and the parsed value is fully typed inside the resolver. Schemas can be reused and composed with omit, partial, and extend.

React Query caches results independently, so you must invalidate them manually. Call utils.yourRouter.yourProcedure.invalidate() inside the mutation's onSuccess callback using the trpc.useContext() helper to trigger a refetch.

tRPC is a poor fit when your API must be consumed by non-TypeScript clients, since its type safety relies on sharing the AppRouter type within a TypeScript codebase. Public or multi-language APIs are better served by REST or GraphQL with explicit schemas.