Building the Centralized Identity Hub: Secure API Handlers with Next.js & Prisma (Part 2)

Introduction In Part 1, we discussed the architectural necessity of a Single Source of Truth (SSoT) and designed a robust PostgreSQL schema using Prisma. We established that managing users manually across fragmented services is a liability. Today, we move from design to implementation. We will build the Identity Hub's engine using Next.js Route Handlers. Our goal is to create a secure, high-performance API that allows our "Spoke" applications (like Laravel services) to authenticate users and verify permissions without owning the data. 1. The Security Handshake: Service-to-Service Auth Since our Identity Hub is a private internal service, we cannot leave the API endpoints open. We need a way to ensure that only authorized "Spoke" applications can talk to our Next.js Hub. For this implementation, we will use a Secret Header-based Authentication (or an API Key). import { headers } from 'next/headers'; export function validateServiceSecret() { const headerList = headers(); const apiKey = h