Protect the Next.js route that serves the resource.

BOUNDARY

Client-side gating is UX, not authorization

React can hide a premium component, but a user can still call the underlying endpoint directly if the server never verifies access.

Place the authorization check in the Route Handler, Server Action or other trusted server code that controls the resource.

AUTH

Start from a trusted wallet session

Authenticate the wallet first, then pass the wallet identity established by that server-side session into AccessVerdict.

Keep the AccessVerdict API key in a server environment variable and never expose it through NEXT_PUBLIC_ configuration.

VERIFY

Call one policy before returning protected data

The same request shape works whether the policy is an allowlist, ERC-20 balance, ERC-721 ownership or ERC-1155 token balance.

const response = await fetch("https://accessverdict.dev/api/v1/verify", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ACCESSVERDICT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ policyId, wallet }),
});

const verdict = await response.json();

RESPONSES

Map denied and unavailable verification differently

A conclusive denied result can map to 403. A verification or adapter failure should map to a temporary unavailable path such as 503 rather than pretending the policy failed.

MIGRATION

Replace one protected route before adding more infrastructure

Start with the route that already contains token/RPC logic. Move just that decision behind AccessVerdict, verify both allowed and denied cases, then expand only if the integration reduces real code.