Authentication Middleware — Protecting Your Endpoints

You've built API routes and validated their inputs. But right now, anyone on the internet can call your endpoints. A random bot, a curious hacker, your competitor — anyone who knows the URL can create, read, update, and delete data.

That's obviously not okay.

Authentication answers "who are you?" Authorization answers "what are you allowed to do?" In this lesson, we'll set up both using Clerk and Next.js middleware, so your API routes are locked down before a single line of route handler code runs.

How Middleware Works in Next.js

Middleware in Next.js runs before your route handlers. It sits between the incoming request and your code, intercepting every request to check whether it should proceed.

Request → Middleware → Route Handler → Response
              ↓