Hello! I have a Next app with app router. We have an external backend written in Nestjs.

We are trying to use NextAuth.js to have server sessions for authentication. I manage to log in and everything, no problem, but now we have Redux stores client side that need to make API calls with the appropriate token to the backend.

We don't use route handlers for our API because the NestJS backend predates our frontend. From what I understand, the token I need to send in my external API request via Redux exists on server side but not client side for security reasons. So my question is: how can my redux requests have the token so that my API can validate the requests?

I had the idea of creating a proxy next api that injects the token and then forwards the request. I managed to reroute requests from redux with a rewrite(), but I don't know how can I can inject the token (I don´t think I can do a middleware with a rewrite because it doesn't actually create an API route in Nextjs).

I'm open to any suggestions. Perhaps a server session isn't adapted to what we're doing since we already have a backend? In this case, can NextAuth handle the authorization code flow with PKCE so that I can stock my token client side?

Thanks for any advice you can give.