docs / guides/sessions
Sessions
Understand access tokens, refresh, rotation, and revocation.
Session boundary
The Next.js adapter stores access and refresh tokens in secure, HTTP-only cookies. Browser components call your same-origin Vulyo proxy instead of reading tokens directly.
Validation and refresh
- Access tokens are verified against Vulyo public signing keys.
- The server confirms the session is still active before trusting it.
- Eligible sessions are refreshed and rotated before expiry.
- Sign-out and session revocation clear the local session cookies.
Read the current session
import { auth } from "@vulyo/nextjs/server";export async function updateAccount() { "use server"; const session = await auth(); if (!session.isAuthenticated) { throw new Error("Sign in to continue."); } return session.user;}