On day two I tackled auth. NextAuth’s CredentialsProvider fit perfectly: user signup writes to Upstash KV (user:<email>), and sign-in pulls session.user from KV. I guarded every page server-side with getServerSession, and built a /api/me endpoint so I could hide or show UI based on role.
I also sketched out the profile API:
- GET
/api/profilereturns{ name, bio, avatarUrl } - PUT
/api/profilewrites updates back to KV
With that under my belt, I had a secure base for all user data.