Server-First Pattern
The storefront follows a server-first architecture where all API calls are made server-side. The Spree API key is never exposed to the browser.- Server Actions (
src/lib/data/) — call@spree/sdkdirectly with auth/cookie helpers fromsrc/lib/spree - httpOnly Cookies — auth tokens, cart tokens, and locale are stored securely
- No Client-Side API Calls — the Spree API key stays on the server
- Auto-Localization — locale and country are read from cookies via
getLocaleOptions()
Project Structure
(wholesale) route group is an opt-in B2B portal, off unless a wholesale channel is configured. Its gating, surfaces, and pricing modes are covered in the Wholesale Portal guide.
Authentication Flow
- User submits login form
- Server action calls
@spree/sdkto authenticate - JWT token is stored in an httpOnly cookie via
src/lib/spreecookie helpers - Subsequent requests use
withAuthRefresh()which reads the token from cookies automatically - Token is never accessible to client-side JavaScript
Multi-Region
The storefront serves multiple countries, currencies, and languages from one deployment via/{country}/{locale} URL segments and an edge middleware that detects and persists the visitor’s region. See the Multi-Region guide.
Server Actions
All data fetching is done through server actions insrc/lib/data/. These call @spree/sdk directly, using src/lib/spree helpers for auth and locale:

