Next.js
Use the JavaScript SDK in browser code with a project user session. Keep TEFILY_SERVICE_TOKEN on the server only.
NEXT_PUBLIC_TEFILY_API_URL=https://api.tefily.comNEXT_PUBLIC_TEFILY_PROJECT_ID=TEFILY_SERVICE_TOKEN=NEXT_PUBLIC_* is compiled into the client bundle. Never put kfxs_… or kfx_… there.
Client
Section titled “Client”import { KataflaxClient } from '@kataflax/sdk';
export function createBrowserClient() { return new KataflaxClient({ baseUrl: process.env.NEXT_PUBLIC_TEFILY_API_URL!, projectId: process.env.NEXT_PUBLIC_TEFILY_PROJECT_ID!, });}Register/login, then collection('posts').list(). Enable project auth and owner rules before shipping.
Server routes
Section titled “Server routes”Route handlers that need to write as the project (password reset, webhooks) should use a service token. See Backend service token.
The data API reflects Origin for CORS, so the browser can call https://api.tefily.com directly. You do not have to proxy CRUD through Next.js unless you want to hide filters or attach a service token (which you should not expose).