Neon RLS Authorize + Stack Auth Example (SQL from the Backend)

A quick start Next.js template demonstrating secure user authentication and authorization using Neon RLS Authorize with Stack Auth integration. This guide primarily uses SQL from the backend to enforce row-level security policies.

Features

• Next.js application with TypeScript
• User authentication powered by Stack Auth
• Row-level security using Neon RLS Authorize
• Database migrations with Drizzle ORM
• Ready-to-deploy configuration for Vercel, Netlify, and Render

Prerequisites

• Neon account with a new project
• Stack Auth account with a new project
• Node.js 18+ installed locally

One-Click Deploy

Deploy directly to your preferred hosting platform:

Make sure to add your website URL as a Trusted Domain on your Stack Auth project settings.

Local Development Setup

1. Configure Stack Auth

1. Sign up for a Stack Auth account and create a new project.

2. Navigate to the project settings and create an API key.

3. Upon creating the API key, you will receive NEXT_PUBLIC_STACK_PROJECT_ID, NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY and STACK_SECRET_SERVER_KEY. Keep these handy for the next steps.

   

2. Set Up Neon RLS Authorize

1. Open your Neon Console and click "RLS Authorize" in your project's settings

2. Add a new authentication provider

3. Set the JWKS URL to: https://api.stack-auth.com/api/v1/projects/<project-id>/.well-known/jwks.json

   Replace <project-id> with your Stack Auth project ID

   

3. Local Installation

1. Clone the repository:

   git clone https://github.com/neondatabase-labs/stack-nextjs-neon-rls-authorize
   cd stack-nextjs-neon-rls-authorize

2. Install dependencies:

   npm install

3. Create .env file with the following variables:

   NEXT_PUBLIC_STACK_PROJECT_ID=
   NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY=
   STACK_SECRET_SERVER_KEY=
   
   # Database connections
   DATABASE_URL=              # neondb_owner role connection
   DATABASE_AUTHENTICATED_URL= # authenticated role connection

   Get your Stack Auth keys from your Stack Auth project dashboard.

4. Set up the database:

   npm run drizzle:generate  # Generate migrations
   npm run drizzle:migrate  # Apply migrations

5. Start the development server:

   npm run dev

6. Visit http://localhost:3000 to see the application running.

   

Important: Production Setup

1. Upgrade your Stack Auth project to production mode by navigating to the project settings.
2. Verify that the JWKS URL in your Neon RLS Authorize configuration is correctly pointing to your Stack Auth project.

Learn More

• Neon RLS Authorize Tutorial
• Simplify RLS with Drizzle
• Stack Auth Documentation
• Neon RLS Authorize + Stack Auth Integration

Authors

• David Gomes

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.