One command
Scaffold with npx @zindua/create-app@latest my-app. Setup wizard runs in the browser after npm run dev.
Zindua for Next.js
Scaffold a Next.js app with email and WhatsApp OTP. @zindua/sdk stays on the server. Route Handlers call Zindua. The browser never sees the key.
npx @zindua/create-app@latest my-appKeys on server
ZINDUA_API_KEY lives in .env.local only. Route Handlers call the API, never the browser.
Email + WhatsApp
OTP channel (email or whatsapp) and template language are set in .env.local, not in the UI.
i18n routes
Localized pages at /en, /fr, /es with a locale switcher. UI language is separate from OTP template lang.
Quick start
One panel. Every snippet.
Click a topic — the code updates in place.
terminal
1npx @zindua/create-app@latest my-app2cd my-app3npm install4npm run dev5 6# Browser wizard at /setup — API key, channels, template, auth mode7# Restart dev server when setup finishes (Ctrl+C, npm run dev)8 9# Optional Neon after password auth in wizard:10# npm run db:pushUse npx, not npm i. SDK: npm install @zindua/sdk v1.4.1.
Setup
Seven steps
Configure Zindua first, then scaffold. Same template slug for email and WhatsApp.
01
Create a Zindua project
Sign up at zindua.run, create a project, and copy the API key from Dashboard → Projects. Use a test key locally, live key in production.
Stack
Neon, Drizzle, Zustand
Optional Postgres. Falls back to in-memory OTP when DATABASE_URL is unset.
No DATABASE_URL → in-memory OTP.
Neon Postgres
Optional DATABASE_URL. Persists users, sessions, OTP codes, audit logs, and devices. Required for password register/login.
Security
API keys never leave Next
The SDK throws in the browser. Client Components call your Route Handlers; Route Handlers call Zindua.
Browser
(Client Components)
Cannot call SDK
Route Handlers
app/api/**/route.ts
Zindua API
API key stays on the server
Browser → your API → Zindua
- Server-only API key. ZINDUA_API_KEY belongs in .env.local or your host's secret env vars. Never prefix it with NEXT_PUBLIC_.
- Route Handlers only. @zindua/sdk runs in app/api/**/route.ts. Client components call your own /api/auth/* endpoints.
- No secrets in git. .env.local is gitignored. Commit only .env.example with placeholder values.
- Rotate if leaked. Regenerate the project API key in the dashboard immediately if a real key was exposed.
Reference
Auth, SDK, and errors
One panel. Pick a topic, then a row.
Password modes need Neon.
AUTH_MODE
otp
AUTH_MODE=otp
OTP only (default)
Scaffold
What you get
The App Router tree @zindua/create-app writes. Open a file in the explorer.
my-app — Zindua
Explorer
zindua.ts
Server-only SDK client
1import { Zindua } from "@zindua/sdk";
2
3export function getZindua() {
4 const apiKey = process.env.ZINDUA_API_KEY;
5 if (!apiKey) throw new Error("ZINDUA_API_KEY is missing");
6 return new Zindua({ apiKey });
7}
mainmy-app/lib/zindua.tsTypeScript
Scaffold project
npx @zindua/create-app@latest my-appSwitch UI
npx @zindua/create-app@latest templateSync auth engine
npx @zindua/create-app@latest updateDiagnose setup
npx @zindua/create-app@latest doctor
Ship OTP on Next.js today
Scaffold with @zindua/create-app, paste your key in /setup, and send from a Route Handler.