Direct or backend proxy: choosing an auth mode

Shipstack Auth can run in two modes. The right one depends on how much of the flow you want to own.

The SDK in your client talks straight to Shipstack with your publishable key. It is the fastest way to get going and there is nothing extra to host.

The client only talks to an auth handler inside your own backend. That handler relays requests to Shipstack, so no key ever reaches the browser. It works with a Next.js app or with a separate backend.

Start with direct mode for prototypes. Move to backend proxy when you want your server to be the only party that talks to Shipstack.