Originally published at htpbe.tech. The version on htpbe.tech stays in sync with the latest detection algorithm — refer to it for the canonical text.
A Next.js app that accepts document uploads has a specific problem: the file never touches a long-lived server you control. It lands in a serverless function with a body-size ceiling, runs for a few hundred milliseconds, and disappears. If a user submits a bank statement, a payslip, or an invoice, your App Router handler has one chance to decide whether that file is trustworthy before it influences a payment, a credit limit, or a hire.
This guide shows the production pattern for wiring PDF tamper detection into a Next.js 14/15 App Router application: a route handler that runs on the Node.js runtime, a presigned client-side upload so large PDFs never hit your function body, a server-side call to the analysis API, and a typed result UI. The code below is end-to-end TypeScript — it compiles, runs the request flow, and handles the documented error codes — but you still need to harden it for your own environment (CORS on the bucket, bucket lifecycle policy, abuse protection on the upload-url route, log redaction, auth on routes that mint URLs). The hardening checklist is in the security section near the end. (If you are on plain Node.js or Express, the Node.js integration guide covers that surface; for Python and Django/Flask, see the Python guide. For the conceptual model, start with how PDF tamper detection works.)
