> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookfish.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Next.js

> Mount Hookfish in a Next.js App Router route handler.

Mount Hookfish below `/api` with an optional catch-all App Router route. The
handler uses the Node.js runtime so it can use the database adapters and
provider SDKs included with Hookfish.

## Install dependencies

```bash theme={null}
pnpm add @hookfish/api @hookfish/database @hookfish/providers
```

Create `hookfish.config.ts` using the same configuration shown in the
[Hono guide](/frameworks/hono). Use PGlite only for local development or a
single persistent Node process. Use PostgreSQL for horizontally scaled or
ephemeral deployments.

## Create the route handler

Create `app/api/[[...path]]/route.ts`:

```ts theme={null}
import path from 'node:path'
import { HookfishServer } from '@hookfish/api'
import { pglite } from '@hookfish/database/pglite'
import config from '../../../hookfish.config'

export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'

const db = pglite(
  process.env.PGLITE_DATA_DIR ?? path.resolve(process.cwd(), 'hookfish-data'),
)
const hookfishPromise = HookfishServer.init({ ...config, db })

async function handle(request: Request) {
  const hookfish = await hookfishPromise
  return hookfish.fetch(request, process.env)
}

export {
  handle as DELETE,
  handle as GET,
  handle as HEAD,
  handle as OPTIONS,
  handle as PATCH,
  handle as POST,
  handle as PUT,
}
```

Adjust the relative config import to match your project structure.

## Add authenticated application routes

Keep user authentication in normal Next.js route handlers. After validating
the session and permissions, use the typed Hono client to call Hookfish from
the server:

```ts theme={null}
import type { AppType as HookfishAppType } from '@hookfish/api'
import { hc } from 'hono/client'

export async function GET(request: Request) {
  const session = await authenticateNextRequest(request)
  if (!session) {
    return Response.json({ error: 'Sign in required.' }, { status: 401 })
  }

  const brokerToken = await scopedBrokerTokenFor(session.organizationId)
  const hookfish = hc<HookfishAppType>(`${process.env.HOOKFISH_URL}/api`, {
    headers: {
      Authorization: `Bearer ${brokerToken}`,
    },
  })

  return hookfish.oauth.connections.$get({
    query: {
      connection_id_prefix: session.organizationId,
    },
  })
}
```

Place this handler at an application-owned path such as
`/api/integrations/connections`. The browser sends its normal Next.js session
to that path and never receives the broker token.

See [Application authentication](/authentication/application-auth) for the
Hono RPC pattern and tenant-isolation guidance.