Next.js SaaS Auth Production Checklist: Sessions, Roles, and Edge Cases

Auth demos pass locally and fail under real tenants. Production SaaS needs a written contract: how sessions are stored, how roles are checked on every sensitive route, and what happens when invites expire or a user belongs to multiple workspaces.

Prefer server-verified sessions for admin and billing routes. If you use JWTs in cookies, set short lifetimes, rotate refresh tokens, and never trust client-decoded claims for authorization. Middleware can gate coarse access; database role checks must still run for mutations.

Invite and onboarding flows are where bugs hide. Test: invite to an existing email, invite to a new email, accept on a different device, and revoke before accept. Race conditions create duplicate tenants or orphan memberships that support cannot explain.

Multi-tenant isolation is not optional. Every query that returns customer data needs an explicit tenant/workspace predicate. Log the actor id on privileged actions. Soft-delete users carefully — billing and audit trails often still need the row.

Account recovery and MFA reset paths need the same rigor as login. SMS and email reset tokens should be single-use, rate-limited, and invalidated on password change. Support tools that “log in as user” must be audited and time-boxed.

If your Next.js SaaS auth feels fragile after a handoff, start with a free audit of auth routes and tenancy queries. I will map leak risks and a fixed-price hardening plan before you add more features on sand.