Skip to main content
Find your symptom and open it.
Neither /api/health nor /auth/me exists, so if something sent you looking for them, that is why they 404.What the frontend actually uses is the auth cookie in middleware plus GET /user/self, which comes back empty when you are not signed in. That is the call to watch in the network tab.Signed in and /user/self still 404s? NEXT_PUBLIC_BACKEND_URL does not match the URL your browser is using. A mismatched protocol or port breaks the session cookie.
JWT_SECRET signs session tokens, so regenerating it invalidates every existing session.
Everyone signing in again is the mild half. Unless you have set ENCRYPTION_KEY, this same value also encrypts your API keys, the OAuth client secrets she issues, saved provider credentials and cookie logins such as Skool. Rotating it in that state leaves those rows undecryptable, and every connection depending on them has to be set up again by hand.Channels connected through a normal OAuth flow survive: their tokens are stored as the network returned them.Already rotated and your channels have gone dark? Put the old value back. That is the whole recovery. Then set ENCRYPTION_KEY to that old value before rotating anything, which separates the two jobs. Configuration reference.
Set JWT_SECRET once at first deployment. Keep it in a secret manager, a Docker or Kubernetes secret, or an untracked .env on the host. Never commit it, including to a private deploy repo: anyone with repo access then holds the signing key for every session token she has ever issued.
The backend builds its CORS allowlist from FRONTEND_URL, plus MAIN_URL if set. Reach her on a hostname or port outside that list and the call is rejected.Make FRONTEND_URL match the URL you use in the browser exactly, protocol and port included.

​
Next steps

Configuration reference

Every variable she reads, including the two above

Email configuration

Why an activation mail may never have been sent

Domain and HTTPS

Getting the URLs and the cookie domain right

Still stuck?

What to put in a report so the first reply is the useful one