Bearer authentication,
built for Nuxt.
Keep API tokens on the server. Give your Nuxt application secure, SSR-aware authentication with Redis-backed sessions and HTTP-only cookies.
How Nuxt Bearer Auth Isolates Tokens
Browser
Vue / Nuxt SPA
Nuxt Server
Nitro Auth Gateway
Redis Cache
Session Store (TTL)
External API
Laravel / REST API
Browser sends login request to local Nuxt endpoint (/api/auth/login).
Bearer tokens don’t belong in your browser.
When single-page apps store raw bearer tokens in localStorage or JavaScript variables, any XSS vulnerability or malicious dependency can immediately exfiltrate the token.
- ✕Tokens become accessible to browser JavaScript & XSS.
- ✕SSR auth hydration becomes fragmented and flickers.
- ✕Refresh tokens are exposed on the client device.
- ✕No centralized server session revocation or device management.
Tokens stay on the server. Always.
The browser knows about the session, but the browser never needs to know the API’s bearer token. Nuxt holds the real bearer credentials in Redis and gives your client a secure HTTP-only cookie.
- ✓Zero token leakage to client-side scripts.
- ✓First-class SSR hydration with zero layout shift.
- ✓Silent token refresh executed entirely server-side.
- ✓Instant remote session revocation across all devices.
Infrastructure Features
Engineered for production reliability
Server-Side Sessions
Bearer tokens are kept safely in server-side Redis sessions, never stored in browser memory or localStorage.
HTTP-Only Cookies
The browser receives a protected, secure session cookie rather than the external API access token.
SSR Authentication
Authentication state is hydrated synchronously during Nuxt SSR with zero layout shifts or client auth flicker.
Route Protection
Protect Nuxt pages using intelligent global route middleware that redirects unauthenticated users automatically.
Server API Protection
Guard your custom Nitro server API routes with session verification and pre-authenticated external API callers.
Silent Token Refresh
Refresh backend authentication tokens on the server without exposing long-lived refresh tokens to the browser.
Session Management
List active user sessions across multiple devices with IP/user-agent tracking and individual remote revocation.
CSRF Protection
Integrated nuxt-csurf protection guards against Cross-Site Request Forgery across mutating HTTP methods.
OTP Verification Flows
Built-in support for account verification, two-factor OTP authentication, and resend workflows.
Social Authentication
Easily forward Google, Apple, and GitHub OAuth credentials to your backend authentication provider.
Backend Agnostic
Engineered for any bearer-token API (Laravel Sanctum, FastAPI, Django REST, Node, Go, Rails).
Configurable Response Paths
Map arbitrary JSON response payloads into normalized session state without backend modifications.
Developer Experience
Authentication without the boilerplate.
// pages/login.vue
<script setup lang="ts">
const auth = useBearerAuth()
async function handleLogin(email: string, pass: string) {
// 1. Sends credentials to Nuxt local endpoint /api/auth/login
// 2. Nuxt server authenticates with your backend API
// 3. Nuxt receives bearer token and stores it in Redis
// 4. Browser receives an HTTP-only session cookie
await auth.login({
email,
password: pass,
})
if (auth.isAuthenticated.value) {
await navigateTo('/dashboard')
}
}
</script>Ready to secure your Nuxt application?
Install the package in under two minutes, connect your Redis instance, and keep bearer tokens off the client forever.