Input Validation With Zod — Never Trust the Client

There is one rule in API development that you must internalize completely: never trust the client. Ever.

It doesn't matter if you built the frontend. It doesn't matter if your React form has validation. It doesn't matter if you think no one would send bad data. Your API will receive garbage. Bots will probe it. Bugs in your frontend will send incomplete data. Users will find ways to submit things you didn't expect.

Your backend must validate every single piece of input. And Zod makes this almost effortless.

Why Not Just Check Manually?

You could validate by hand:

export async function POST(request: NextRequest) {
  const body = await request.json();
 
  if (!body.email) return NextResponse.json({ error: 'Email is required' }, { status: 400 });
  if (typeof body.em