SDK proxy
Why framework SDKs proxy Zitadel requests through the app origin.
Framework SDKs keep auth traffic same-origin where possible.
For Next.js and Nuxt, the SDK middleware proxies /__nextgen/* requests to the Zitadel backend, verifies session JWTs, and redirects unauthenticated users away from protected routes.
This keeps the app in control of browser-visible routes and cookies while Zitadel remains the backend API.
The default proxy path is:
/__nextgenThe login and logout components call the same-origin proxy path by default when configured through the SDK.
SPAs in production
Single-page apps (React, Vue, Angular, Solid, Svelte, Qwik) have no server of their own. In local development the CLI scaffolds a dev-server proxy for /__nextgen/*; in production the same-origin path comes from the hosting platform instead: a vercel.json rewrite, a netlify.toml redirect, or a minimal Cloudflare worker (Cloudflare redirects cannot proxy external origins).
ADR 036 removes the project-secret requirement from this browser-facing path — a browser-safe, origin-checked credential replaces it, with the project's origin allowlist as the enforcement boundary — so these platform entries are plain config with no secrets in platform env stores. The credential rollout and CLI scaffolding for the platform configs are tracked in zitadel/nextgen#560; until that lands, the dev proxy covers local development only.