FAQ
Short answers to the questions buyers ask most.
General#
Which technologies does the kit use?
Frontend: Next.js 16 (App Router), TypeScript, Tailwind CSS, Redux Toolkit Query, next-themes. Backend: Node.js, Express 4, MongoDB (Mongoose 8), JWT cookie auth, Resend email API.
Is this repository a workspace (install from the root)?
No. There is no root package.json or pnpm-workspace.yaml — backend/ and frontend/ are independent projects and must be installed and run separately (see Getting Started).
How long do login sessions last?
The access-token JWT default expiry is 7 days (JWT_EXPIRES_IN) and the refresh token lasts 30 days (JWT_REFRESH_EXPIRES_IN) with server-side rotation — both values are configurable in backend/.env.
How do I make sure my admin account is safe?
Set ADMIN_EMAIL and ADMIN_PASSWORD to your own values in backend/.env BEFORE running node seed-admin.js — the script has built-in defaults written in its source, which every buyer of the kit can read. Never keep those defaults in production.
Why is an OTP shown on the forgot-password form during development?
For testing without a Resend API key. It disappears when NODE_ENV=production — the code is then only delivered by email.
Which URL does Google OAuth call back to?
http://localhost:5000/api/v1/auth/google/callback in development, then the backend redirects the browser to the frontend /auth/verify-otp page for the emailed verification code. The string must be registered exactly in Google Console (see the Google OAuth guide).
Do I need NEXT_PUBLIC_API_URL?
Yes — and it must INCLUDE the /api/v1 prefix (e.g. http://localhost:5000/api/v1), because the Next.js proxy re-attaches :path* onto the value and the Google button builds its URL from it. Without the prefix the API 404s.
Customization#
Can I add more roles?
The role field is a simple string; extend the Joi schema, the protect/authorize middleware and any admin filters when you add new roles.
Can I use another email provider instead of Resend?
The bundled implementation is Resend (HTTP API). To switch providers, replace backend/src/services/emailService.js with the provider's SDK and keep the same sendEmail() return shape. The old SMTP variables are no longer read.
Is Stripe billing included?
Not yet. Stripe variables are reserved in the config schema but no billing feature is implemented — plan accordingly.