A practical guide to auditing authentication in a Next.js SaaS starter before it breaks across preview URLs, production domains, and protected routes.
Authentication is one of the easiest features to demo and one of the easiest features to break.
A sign-in button proves almost nothing by itself. Real SaaS auth has to survive production domains, preview deployments, OAuth callbacks, magic links, session refresh, protected routes, billing states, role checks, account deletion, and sometimes organisations or custom domains.
When evaluating a Next.js SaaS starter, treat auth as a system, not a screen.
The happy-path demo hides the hard parts
