Authentication - remix.world

Browser sessions (Dynamic)

The web app uses Dynamic (@dynamic-labs/sdk-react-core) for authentication. Client utilities import getAuthToken from @/lib/dynamic, which re-exports Dynamic SDK helpers.

Calling first-party `/api` routes

Authenticated fetches use the X-Authorization header (note: not Authorization):

GET /api/users/current HTTP/1.1
Host: remix.world
X-Authorization: Bearer <dynamic_jwt>

The shared helper fetchJSONWithAuth in lib/client/fetcher.ts sets:

headers: { "X-Authorization": `Bearer ${getAuthToken()}` }

Server-to-backend calls

lib/server/fetcher.ts copies the user token into outbound requests to NEXT_PUBLIC_API_BASE_URL using the same header name pattern for backend routes that expect the Dynamic JWT.

curl example

curl -sS 'https://remix.world/api/users/current' \
  -H "X-Authorization: Bearer $DYNAMIC_JWT"

Next

API routes