Next.js adapter

The unitpayHandler from @unitpay/react/next lets you route SDK calls through your Next.js backend instead of calling the UnitPay API directly. The secret key stays server-side, and requests never leave your domain.

Usage

Add a catch-all route handler:

// app/api/unitpay/[...path]/route.ts
import { unitpayHandler } from '@unitpay/react/next';

const handler = unitpayHandler({
  apiKey: process.env.UNITPAY_SECRET_KEY!,
  apiBaseUrl: 'https://api.useunitpay.com/v1',
  allowedOrigins: [process.env.NEXT_PUBLIC_APP_URL!],
  getCustomerId: async (request) => resolveCustomerFromSession(request),
});

export {
  handler as GET,
  handler as POST,
  handler as PUT,
  handler as PATCH,
  handler as DELETE,
};

Then point the provider at the proxy instead of the API:

import { UnitPayProvider } from '@unitpay/react';

<UnitPayProvider config={{ customerId: 'cus_...', proxyBaseUrl: '/api/unitpay' }}>
  <App />
</UnitPayProvider>

Parameters

string

required

Your UnitPay secret key. Read it from a server-only environment variable — never expose it to the browser.

(request: Request) => Promise<string | null>

required

Resolve the authenticated customer for the incoming request (from your session/auth). Return null for an unauthenticated request — the handler responds 401.

string

UnitPay API base URL. Defaults to https://api.useunitpay.com/v1.

string[] | '*'

Origins permitted to call the proxy. Requests with an Origin outside this list are rejected with 403. Pass '*' to disable the check (not recommended in production). When omitted, the Origin check is skipped.

number

Maximum request body size. Defaults to 1 MB; larger bodies are rejected with 413.

Security defaults: disallowed methods → 405; off-allowlist Origin → 403; oversized bodies → 413. Only GET, POST, PUT, PATCH, and DELETE are forwarded.

Overview

Building blocks

Next.js adapter

Usage

Parameters

​Usage

​Parameters

Usage

Parameters