auth-engine · Q-Niranjan · Jun 23, 2026 · Jun 23, 2026
diff --git a/src/app/(auth)/login/page.tsx b/src/app/(auth)/login/page.tsx
@@ -34,11 +34,8 @@ import {
     PublicTenantAuthConfig,
 } from "@/lib/types";
 import { getApiErrorMessage, isNotAllowedError } from "@/lib/errors";
-import {
-    PLATFORM_TENANT_ID,
-    PublicOAuthProvider,
-    SOCIAL_PROVIDER_META,
-} from "@/lib/social-login";
+import { getPlatformTenantId, PublicOAuthProvider, SOCIAL_PROVIDER_META } from "@/lib/social-login";
+import { getPublicEnv } from "@/lib/public-env";
 import { isWebAuthnSupported } from "@/lib/webauthn-support";
 import { LoginFormSkeleton } from "@/components/auth/login-form-skeleton";
 
@@ -243,16 +240,15 @@ function LoginPageContent() {
     }, [enrollData]);
 
     const { data: authConfig, isLoading: isLoadingAuthConfig } = useQuery<PublicTenantAuthConfig>({
-        queryKey: ["publicAuthConfig", PLATFORM_TENANT_ID],
+        queryKey: ["publicAuthConfig"],
         queryFn: async () => {
-            const { data } = await apiClient.get<PublicTenantAuthConfig>("/auth/auth-config", {
-                params: { tenant_id: PLATFORM_TENANT_ID },
-            });
+            const { data } = await apiClient.get<PublicTenantAuthConfig>("/auth/auth-config");
             return data;
         },
-        enabled: !!PLATFORM_TENANT_ID,
     });
 
+    const platformTenantId = authConfig?.tenant_id ?? getPlatformTenantId();
+
     const allowedMethods = new Set(authConfig?.allowed_methods ?? []);
     const showEmailPassword = allowedMethods.has("email_password");
     const showMagicLink = allowedMethods.has("magic_link");
@@ -265,15 +261,17 @@ function LoginPageContent() {
     const { data: socialProviders = [], isLoading: isLoadingSocialProviders } = useQuery<
         PublicOAuthProvider[]
     >({
-        queryKey: ["loginSocialProviders", PLATFORM_TENANT_ID],
+        queryKey: ["loginSocialProviders", platformTenantId],
         queryFn: async () => {
             const { data } = await apiClient.get<PublicOAuthProvider[]>(
                 "/auth/oauth/providers",
-                { params: { tenant_id: PLATFORM_TENANT_ID } }
+                platformTenantId
+                    ? { params: { tenant_id: platformTenantId } }
+                    : undefined
             );
             return data;
         },
-        enabled: !!PLATFORM_TENANT_ID && showSocial,
+        enabled: !!platformTenantId && showSocial,
     });
 
     const passwordForm = useForm<z.infer<typeof loginSchema>>({
@@ -315,15 +313,15 @@ function LoginPageContent() {
     const sendMagicLink = async (email: string) => {
         await apiClient.post("/auth/magic-link/request", {
             email,
-            tenant_id: PLATFORM_TENANT_ID || undefined,
+            tenant_id: platformTenantId || undefined,
         });
     };
 
     const loginMutation = useMutation({
         mutationFn: async (values: { email: string; password: string }) => {
             const { data } = await apiClient.post("/auth/login", {
                 ...values,
-                tenant_id: PLATFORM_TENANT_ID || undefined,
+                tenant_id: platformTenantId || undefined,
             });
             return data;
         },
@@ -446,7 +444,7 @@ function LoginPageContent() {
 
         try {
             const { data } = await apiClient.post("/auth/webauthn/authenticate/begin", {
-                tenant_id: PLATFORM_TENANT_ID || undefined,
+                tenant_id: platformTenantId || undefined,
             });
 
             const assertion = await startAuthentication({ optionsJSON: data.options });
@@ -465,7 +463,7 @@ function LoginPageContent() {
                             userHandle: assertion.response.userHandle,
                         },
                     },
-                    tenant_id: PLATFORM_TENANT_ID || undefined,
+                    tenant_id: platformTenantId || undefined,
                 }
             );
 
@@ -482,7 +480,7 @@ function LoginPageContent() {
     };
 
     const handleSocialLogin = (provider: string, tenantId: string) => {
-        const baseUrl = process.env.NEXT_PUBLIC_API_URL;
+        const baseUrl = getPublicEnv().API_URL;
         const params = new URLSearchParams({ tenant_id: tenantId });
         window.location.href = `${baseUrl}/auth/oauth/${provider}/login?${params.toString()}`;
     };

diff --git a/src/app/layout.tsx b/src/app/layout.tsx
@@ -3,6 +3,7 @@ import { Geist, Geist_Mono } from "next/font/google";
 import "./globals.css";
 import { ThemeProvider } from "@/components/theme-provider";
 import Providers from "@/components/providers";
+import { RuntimeEnv } from "@/components/runtime-env";
 import { Toaster } from "@/components/ui/sonner";
 
 const geistSans = Geist({
@@ -27,6 +28,9 @@ export default function RootLayout({
 }>) {
   return (
     <html lang="en" suppressHydrationWarning>
+      <head>
+        <RuntimeEnv />
+      </head>
       <body
         className={`${geistSans.variable} ${geistMono.variable} antialiased`}
       >

diff --git a/src/components/contact-form.tsx b/src/components/contact-form.tsx
@@ -8,6 +8,7 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Textarea } from "@/components/ui/textarea";
+import { getPublicEnv } from "@/lib/public-env";
 
 const COMPANY_SIZES = ["1–10", "11–50", "51–200", "201–1,000", "1,000+"];
 const MAU_RANGES = [
@@ -63,8 +64,7 @@ export function ContactForm() {
       return;
     }
 
-    const apiBase =
-      process.env.NEXT_PUBLIC_API_URL || "http://localhost:8000/api/v1";
+    const apiBase = getPublicEnv().API_URL || "http://localhost:8000/api/v1";
 
     setIsSubmitting(true);
     try {

diff --git a/src/components/runtime-env.tsx b/src/components/runtime-env.tsx
@@ -0,0 +1,15 @@
+export function RuntimeEnv() {
+    const config = {
+        API_URL: process.env.NEXT_PUBLIC_API_URL ?? "",
+        APP_URL: process.env.NEXT_PUBLIC_APP_URL ?? "",
+        PLATFORM_TENANT_ID: process.env.NEXT_PUBLIC_PLATFORM_TENANT_ID ?? "",
+    };
+
+    return (
+        <script
+            dangerouslySetInnerHTML={{
+                __html: `window.__PUBLIC_ENV__=${JSON.stringify(config)}`,
+            }}
+        />
+    );
+}
diff --git a/src/lib/api-client.ts b/src/lib/api-client.ts
@@ -1,10 +1,9 @@
 import axios from "axios";
 import { useAuthStore } from "@/stores/auth-store";
-
-const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || "";
+import { getPublicEnv } from "@/lib/public-env";
 
 export const apiClient = axios.create({
-    baseURL: API_BASE_URL,
+    baseURL: "",
     headers: {
         "Content-Type": "application/json",
     },
@@ -13,6 +12,10 @@ export const apiClient = axios.create({
 // Request Interceptor to add Access Token and Active Tenant
 apiClient.interceptors.request.use(
     (config) => {
+        if (!config.baseURL) {
+            config.baseURL = getPublicEnv().API_URL;
+        }
+
         const state = useAuthStore.getState();
         const token = state.accessToken;
         const tenantId = state.activeTenantId;
@@ -47,7 +50,7 @@ apiClient.interceptors.response.use(
             if (refreshToken) {
                 try {
                     // Note: using raw axios to avoid interceptor infinite loops
-                    const { data } = await axios.post(`${API_BASE_URL}/auth/refresh`, {
+                    const { data } = await axios.post(`${getPublicEnv().API_URL}/auth/refresh`, {
                         refresh_token: refreshToken,
                     });
 

diff --git a/src/lib/public-env.ts b/src/lib/public-env.ts
@@ -0,0 +1,31 @@
+declare global {
+    interface Window {
+        __PUBLIC_ENV__?: {
+            API_URL: string;
+            APP_URL: string;
+            PLATFORM_TENANT_ID: string;
+        };
+    }
+}
+
+export type PublicEnv = {
+    API_URL: string;
+    APP_URL: string;
+    PLATFORM_TENANT_ID: string;
+};
+
+export function getPublicEnv(): PublicEnv {
+    if (typeof window !== "undefined" && window.__PUBLIC_ENV__) {
+        return window.__PUBLIC_ENV__;
+    }
+
+    return {
+        API_URL: process.env.NEXT_PUBLIC_API_URL || "",
+        APP_URL: process.env.NEXT_PUBLIC_APP_URL || "",
+        PLATFORM_TENANT_ID: process.env.NEXT_PUBLIC_PLATFORM_TENANT_ID || "",
+    };
+}
+
+export function getPlatformTenantId(): string {
+    return getPublicEnv().PLATFORM_TENANT_ID;
+}
diff --git a/src/lib/social-login.ts b/src/lib/social-login.ts
@@ -6,7 +6,7 @@ export interface PublicOAuthProvider {
     tenant_id: string;
 }
 
-export const PLATFORM_TENANT_ID = process.env.NEXT_PUBLIC_PLATFORM_TENANT_ID || "";
+export { getPlatformTenantId } from "@/lib/public-env";
 
 export const SOCIAL_PROVIDER_META: Record<
     string,