Adding user authentication to a Next.js app with Whop OAuth

I wrote a tutorial on adding user authentication to an existing Next.js app using Whop OAuth. The TL;DR: drop Sign in with Whop into any Next.js app, skip credential storage, password hashing, email verification, and reset flows. Whop handles those.

Demo: https://nextjs-whop-oauth-demo.vercel.app/

The full integration is a few files: a couple of new modules under lib/, three route handlers under app/api/auth/, and a proxy.ts at the project root. The flow is OAuth 2.0 + PKCE; the session lives in an encrypted httpOnly cookie via iron-session. Here is how it comes together.

What you set up first

Two packages: iron-session for the encrypted session cookie, zod for env and response validation.