Repository: auth0/nextjs-auth0
Pull request #263 (2021-01-29 14:32:06)

Split configuration into Next and Base config
### Description

- separate the config into NextConfig and BaseConfig (I'll come up with a better name when I figure out a better name for `auth0-session`) to make it easier to supply configuration that applies to the Next layer only (eg custom routes)
- Removed a bunch of docs and options that were only specific to the express SDK and got inherited by `auth0-session`

### Testing

- [ ] This change adds test coverage for new/changed/fixed functionality

### Checklist

- [ ] I have added documentation for new/changed functionality in this PR or in auth0.com/docs
- [ ] All active GitHub checks for tests, formatting, and security are passing
- [ ] The correct base branch is being used, if not `master`



Patch:
diff --git a/README.md b/README.md
index dd79e59c..079bebb3 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ AUTH0_CLIENT_ID='YOUR_AUTH0_CLIENT_ID'
 AUTH0_CLIENT_SECRET='YOUR_AUTH0_CLIENT_SECRET'
 ```
 
-For a [full list of configuration options](https://auth0.github.io/nextjs-auth0/interfaces/config.config-1.html) see the docs.
+For a [full list of configuration options](https://auth0.github.io/nextjs-auth0/modules/config.html) see the docs.
 
 Then, create a [Dynamic API Route handler](https://nextjs.org/docs/api-routes/dynamic-api-routes) at `/pages/api/auth/[...auth0].js`.
 
@@ -128,7 +128,7 @@ For more extensive examples see [EXAMPLES.md](./EXAMPLES.md).
 
 ### API Reference
 
-- [Configuration Options](https://auth0.github.io/nextjs-auth0/interfaces/config.config-1.html)
+- [Configuration Options](https://auth0.github.io/nextjs-auth0/modules/config.html)
 
 **Server Side methods**:
 
diff --git a/V1_MIGRATION_GUIDE.md b/V1_MIGRATION_GUIDE.md
index c3675371..8e39649c 100644
--- a/V1_MIGRATION_GUIDE.md
+++ b/V1_MIGRATION_GUIDE.md
@@ -4,7 +4,7 @@ Guide to migrating from `0.x` to `1.x` (Beta)
 
 ### Config changes
 
-> Note: If you only use environment variables to configure the SDK, you don't need to create an instance of the SDK. You can use the named exports (`handleAuth`, `getSession`) directly from `@auth0/nextjs-auth` and they will lazily create an instance of the SDK for you, and configure it using the following [environment variables](https://auth0.github.io/nextjs-auth0/interfaces/config.config-1.html). See the [Basic setup](./EXAMPLES.md#basic-setup) as an example.
+> Note: If you only use environment variables to configure the SDK, you don't need to create an instance of the SDK. You can use the named exports (`handleAuth`, `getSession`) directly from `@auth0/nextjs-auth` and they will lazily create an instance of the SDK for you, and configure it using the following [environment variables](https://auth0.github.io/nextjs-auth0/modules/config.html). See the [Basic setup](./EXAMPLES.md#basic-setup) as an example.
 
 If you still want to create the SDK instance yourself, note that the configuration options have changed as follows.
 
@@ -78,7 +78,7 @@ export default initAuth0({
 });
 ```
 
-See the API docs for a [full list of configuration options](https://auth0.github.io/nextjs-auth0/interfaces/config.config-1.html).
+See the API docs for a [full list of configuration options](https://auth0.github.io/nextjs-auth0/modules/config.html).
 
 ### getSession
 
diff --git a/src/auth0-session/config.ts b/src/auth0-session/config.ts
index 0dabaa08..28a45ba4 100644
--- a/src/auth0-session/config.ts
+++ b/src/auth0-session/config.ts
@@ -3,20 +3,12 @@ import { AuthorizationParameters as OidcAuthorizationParameters } from 'openid-c
 
 /**
  * Configuration properties.
- *
- * ```.env
- * ISSUER_BASE_URL=https://YOUR_DOMAIN
- * CLIENT_ID=YOUR_CLIENT_ID
- * BASE_URL=https://YOUR_APPLICATION_ROOT_URL
- * SECRET=LONG_RANDOM_VALUE
- * ```
  */
 export interface Config {
   /**
    * The secret(s) used to derive an encryption key for the user identity in a session cookie and
    * to sign the transient cookies used by the login callback.
    * Use a single string key or array of keys for an encrypted session cookie.
-   * Can use env key SECRET instead.
    */
   secret: string | Array<string>;
 
@@ -79,20 +71,17 @@ export interface Config {
 
   /**
    * The root URL for the application router, eg https://localhost
-   * Can use env key BASE_URL instead.
    */
   baseURL: string;
 
   /**
    * The Client ID for your application.
-   * Can be read from CLIENT_ID instead.
    */
   clientID: string;
 
   /**
    * The Client Secret for your application.
    * Required when requesting access tokens.
-   * Can be read from CLIENT_SECRET instead.
    */
   clientSecret?: string;
 
@@ -115,23 +104,7 @@ export interface Config {
   enableTelemetry: boolean;
 
   /**
-   * Throw a 401 error instead of triggering the login process for routes that require authentication.
-   * Default is `false`
-   */
-  errorOnRequiredAuth: boolean;
-
-  /**
-   * Attempt silent login (`prompt: 'none'`) on the first unauthenticated route the user visits.
-   * For protected routes this can be useful if your Identity Provider does not default to
-   * `prompt: 'none'` and you'd like to attempt this before requiring the user to interact with a login prompt.
-   * For unprotected routes this can be useful if you want to check the user's logged in state on their IDP, to
-   * show them a login/logout button for example.
-   * Default is `false`
-   */
-  attemptSilentLogin: boolean;
-
-  /**
-   * Function that returns an object with URL-safe state values for `res.oidc.login()`.
+   * Function that returns an object with URL-safe state values for login.
    * Used for passing custom state parameters to your authorization server.
    *
    * ```js
@@ -166,7 +139,6 @@ export interface Config {
 
   /**
    * REQUIRED. The root URL for the token issuer with no trailing slash.
-   * Can use env key ISSUER_BASE_URL instead.
    */
   issuerBaseURL: string;
 
@@ -176,25 +148,7 @@ export interface Config {
    */
   legacySameSiteCookie: boolean;
 
-  /**
-   * Require authentication for all routes.
-   */
-  authRequired: boolean;
-
-  /**
-   * Boolean value to automatically install the login and logout routes.
-   */
   routes: {
-    /**
-     * Relative path to application login.
-     */
-    login: string | false;
-
-    /**
-     * Relative path to application logout.
-     */
-    logout: string | false;
-
     /**
      * Either a relative path to the application or a valid URI to an external domain.
      * This value must be registered on the authorization server.
@@ -285,7 +239,7 @@ export interface CookieConfig {
    * Passed to the [Response cookie](https://expressjs.com/en/api.html#res.cookie) as `samesite`.
    * Defaults to "Lax" but will be adjusted based on {@link AuthorizationParameters.response_type}.
    */
-  sameSite: boolean | 'lax' | 'strict' | 'none';
+  sameSite: 'lax' | 'strict' | 'none';
 }
 
 export interface AuthorizationParameters extends OidcAuthorizationParameters {
diff --git a/src/auth0-session/get-config.ts b/src/auth0-session/get-config.ts
index f8a50892..e287fab0 100644
--- a/src/auth0-session/get-config.ts
+++ b/src/auth0-session/get-config.ts
@@ -133,9 +133,7 @@ const paramsSchema = Joi.object({
   issuerBaseURL: Joi.string().uri().required(),
   legacySameSiteCookie: Joi.boolean().optional().default(true),
   routes: Joi.object({
-    login: Joi.alternatives([Joi.string().uri({ relativeOnly: true }), Joi.boolean().valid(false)]).default('/login'),
-    logout: Joi.alternatives([Joi.string().uri({ relativeOnly: true }), Joi.boolean().valid(false)]).default('/logout'),
-    callback: Joi.string().uri({ relativeOnly: true }).default('/callback'),
+    callback: Joi.string().uri({ relativeOnly: true }).required(),
     postLogoutRedirect: Joi.string().uri({ allowRelative: true }).default('')
   })
     .default()
@@ -155,16 +153,7 @@ export type DeepPartial<T> = {
 export type ConfigParameters = DeepPartial<Config>;
 
 export const get = (params: ConfigParameters = {}): Config => {
-  const config = {
-    secret: process.env.SECRET,
-    issuerBaseURL: process.env.ISSUER_BASE_URL,
-    baseURL: process.env.BASE_URL,
-    clientID: process.env.CLIENT_ID,
-    clientSecret: process.env.CLIENT_SECRET,
-    ...params
-  };
-
-  const { value, error, warning } = paramsSchema.validate(config);
+  const { value, error, warning } = paramsSchema.validate(params);
   if (error) {
     throw new TypeError(error.details[0].message);
   }
diff --git a/src/auth0-session/handlers/callback.ts b/src/auth0-session/handlers/callback.ts
index 9b4b6210..832e875d 100644
--- a/src/auth0-session/handlers/callback.ts
+++ b/src/auth0-session/handlers/callback.ts
@@ -17,13 +17,15 @@ export type CallbackOptions = {
   afterCallback?: AfterCallback;
 };
 
-export default function callbackHandler(
+export type HandleCallback = (req: IncomingMessage, res: ServerResponse, options?: CallbackOptions) => Promise<void>;
+
+export default function callbackHandlerFactory(
   config: Config,
   getClient: ClientFactory,
   sessionCache: SessionCache,
   transientCookieHandler: TransientStore
-) {
-  return async (req: IncomingMessage, res: ServerResponse, options?: CallbackOptions): Promise<void> => {
+): HandleCallback {
+  return async (req, res, options) => {
     const client = await getClient();
 
     const redirectUri = getRedirectUri(config);
diff --git a/src/auth0-session/handlers/login.ts b/src/auth0-session/handlers/login.ts
index a519b4be..2f25c1fb 100644
--- a/src/auth0-session/handlers/login.ts
+++ b/src/auth0-session/handlers/login.ts
@@ -13,8 +13,14 @@ function getRedirectUri(config: Config): string {
   return urlJoin(config.baseURL, config.routes.callback);
 }
 
-export default function loginHandler(config: Config, getClient: ClientFactory, transientHandler: TransientStore) {
-  return async (req: IncomingMessage, res: ServerResponse, options: LoginOptions = {}): Promise<void> => {
+export type HandleLogin = (req: IncomingMessage, res: ServerResponse, options?: LoginOptions) => Promise<void>;
+
+export default function loginHandlerFactory(
+  config: Config,
+  getClient: ClientFactory,
+  transientHandler: TransientStore
+): HandleLogin {
+  return async (req, res, options = {}) => {
     const client = await getClient();
 
     const returnTo = options.returnTo || config.baseURL;
diff --git a/src/auth0-session/handlers/logout.ts b/src/auth0-session/handlers/logout.ts
index 0c91032c..cb2a9e25 100644
--- a/src/auth0-session/handlers/logout.ts
+++ b/src/auth0-session/handlers/logout.ts
@@ -2,18 +2,20 @@ import { IncomingMessage, ServerResponse } from 'http';
 import url from 'url';
 import urlJoin from 'url-join';
 import createDebug from '../utils/debug';
-import { Config } from '../config';
+import { Config, LogoutOptions } from '../config';
 import { ClientFactory } from '../client';
 import { SessionCache } from '../session-cache';
 
 const debug = createDebug('logout');
 
-export interface LogoutOptions {
-  returnTo?: string;
-}
+export type HandleLogout = (req: IncomingMessage, res: ServerResponse, options?: LogoutOptions) => Promise<void>;
 
-export default function logoutHandler(config: Config, getClient: ClientFactory, sessionCache: SessionCache) {
-  return async (req: IncomingMessage, res: ServerResponse, options: LogoutOptions = {}): Promise<void> => {
+export default function logoutHandlerFactory(
+  config: Config,
+  getClient: ClientFactory,
+  sessionCache: SessionCache
+): HandleLogout {
+  return async (req, res, options = {}) => {
     let returnURL = options.returnTo || config.routes.postLogoutRedirect;
     debug('logout() with return url: %s', returnURL);
 
diff --git a/src/auth0-session/index.ts b/src/auth0-session/index.ts
index 616ff2bd..51a6a0cf 100644
--- a/src/auth0-session/index.ts
+++ b/src/auth0-session/index.ts
@@ -2,8 +2,8 @@ export { default as CookieStore } from './cookie-store';
 export { default as TransientStore } from './transient-store';
 export { Config, SessionConfig, CookieConfig, LoginOptions, LogoutOptions, AuthorizationParameters } from './config';
 export { get as getConfig, ConfigParameters, DeepPartial } from './get-config';
-export { default as loginHandler } from './handlers/login';
-export { default as logoutHandler } from './handlers/logout';
-export { default as callbackHandler, CallbackOptions, AfterCallback } from './handlers/callback';
+export { default as loginHandler, HandleLogin } from './handlers/login';
+export { default as logoutHandler, HandleLogout } from './handlers/logout';
+export { default as callbackHandler, CallbackOptions, AfterCallback, HandleCallback } from './handlers/callback';
 export { default as clientFactory, ClientFactory } from './client';
 export { SessionCache } from './session-cache';
diff --git a/src/config.ts b/src/config.ts
index 55d11473..40d6e67d 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -1,93 +1,16 @@
 import { IncomingMessage } from 'http';
 import { AuthorizationParameters as OidcAuthorizationParameters } from 'openid-client';
-import { LoginOptions, DeepPartial } from './auth0-session';
+import { LoginOptions, DeepPartial, getConfig as getBaseConfig } from './auth0-session';
 
 /**
- * ## Configuration properties.
- *
- * The Server part of the SDK can be configured in 2 ways.
- *
- * ### 1. Environmental Variables
- *
- * The simplest way to use the SDK is to use the named exports ({@link HandleAuth}, {@link HandleLogin},
- * {@link HandleLogout}, {@link HandleCallback}, {@link HandleProfile}, {@link GetSession}, {@link GetAccessToken},
- * {@link WithApiAuthRequired} and {@link WithPageAuthRequired}), eg:
- *
- * ```js
- * // pages/api/auth/[...auth0].js
- * import { handleAuth } from '@auth0/nextjs-auth0';
- *
- * return handleAuth();
- * ```
- *
- * When you use these named exports, an instance of the SDK is created for you which you can configure using
- * environmental variables:
- *
- * ### Required
- *
- * - `AUTH0_SECRET`: See {@link secret}
- * - `AUTH0_ISSUER_BASE_URL`: See {@link issuerBaseURL}
- * - `AUTH0_BASE_URL`: See {@link baseURL}
- * - `AUTH0_CLIENT_ID`: See {@link clientID}
- * - `AUTH0_CLIENT_SECRET`: See {@link clientSecret}
- *
- * ### Optional
- *
- * - `AUTH0_CLOCK_TOLERANCE`: See {@link clockTolerance}
- * - `AUTH0_HTTP_TIMEOUT`: See {@link httpTimeout}
- * - `AUTH0_ENABLE_TELEMETRY`: See {@link enableTelemetry}
- * - `AUTH0_IDP_LOGOUT`: See {@link idpLogout}
- * - `AUTH0_ID_TOKEN_SIGNING_ALG`: See {@link idTokenSigningAlg}
- * - `AUTH0_LEGACY_SAME_SITE_COOKIE`: See {@link legacySameSiteCookie}
- * - `AUTH0_POST_LOGOUT_REDIRECT`: See {@link Config.routes}
- * - `AUTH0_CALLBACK`: See {@link Config.routes}
- * - `AUTH0_AUDIENCE`: See {@link Config.authorizationParams}
- * - `AUTH0_SCOPE`: See {@link Config.authorizationParams}
- * - `AUTH0_SESSION_NAME`: See {@link SessionConfig.name}
- * - `AUTH0_SESSION_ROLLING`: See {@link SessionConfig.rolling}
- * - `AUTH0_SESSION_ROLLING_DURATION`: See {@link SessionConfig.rollingDuration}
- * - `AUTH0_SESSION_ABSOLUTE_DURATION`: See {@link SessionConfig.absoluteDuration}
- * - `AUTH0_COOKIE_DOMAIN`: See {@link CookieConfig.domain}
- * - `AUTH0_COOKIE_PATH`: See {@link CookieConfig.path}
- * - `AUTH0_COOKIE_TRANSIENT`: See {@link CookieConfig.transient}
- * - `AUTH0_COOKIE_HTTP_ONLY`: See {@link CookieConfig.httpOnly}
- * - `AUTH0_COOKIE_SECURE`: See {@link CookieConfig.secure}
- * - `AUTH0_COOKIE_SAME_SITE`: See {@link CookieConfig.sameSite}
- *
- * ### 2. Create your own instance using {@link InitAuth0}
- *
- * If you don't want to configure the SDK with environment variables or you want more fine grained control over the
- * instance, you can create an instance yourself and use the handlers and helpers from that.
- *
- * First, export your configured instance from another module:
- *
- * ```js
- * // utils/auth0.js
- * import { initAuth0 } from '@auth0/nextjs-auth0';
- *
- * export default initAuth0({ ...ConfigParameters... });
- * ```
- *
- * Then import it into your route handler:
- *
- * ```js
- * // pages/api/auth/[...auth0].js
- * import auth0 from '../../../../utils/auth0';
- *
- * return auth0.handleAuth();
- * ```
- *
- * **Note** If you use {@link InitAuth0}, you should *not* use the other named exports as they will use a different
- * instance of the SDK.
- *
- * @category Server
+ * @category server
  */
-export interface Config {
+export interface BaseConfig {
   /**
    * The secret(s) used to derive an encryption key for the user identity in a session cookie and
    * to sign the transient cookies used by the login callback.
    * Use a single string key or array of keys for an encrypted session cookie.
-   * Can use env key SECRET instead.
+   * You can also use the AUTH0_SECRET environment variable.
    */
   secret: string | Array<string>;
 
@@ -97,7 +20,8 @@ export interface Config {
   session: SessionConfig;
 
   /**
-   * Boolean value to enable Auth0's logout feature.
+   * Boolean value to enable Auth0's proprietary logout feature.
+   * Since this SDK is for Auth0, it's set to `true`by default.
    */
   auth0Logout: boolean;
 
@@ -133,55 +57,48 @@ export interface Config {
 
   /**
    * The root URL for the application router, eg https://localhost
-   * Can use env key BASE_URL instead.
+   * You can also use the AUTH0_BASE_URL environment variable.
    * If you provide a domain, we will prefix it with `https://` - This can be useful when assigning it to
-   * `VERCEL_URL` for preview deploys
+   * `VERCEL_URL` for Vercel deploys
    */
   baseURL: string;
 
   /**
    * The Client ID for your application.
-   * Can be read from CLIENT_ID instead.
+   * You can also use the AUTH0_CLIENT_ID environment variable.
    */
   clientID: string;
 
   /**
    * The Client Secret for your application.
    * Required when requesting access tokens.
-   * Can be read from CLIENT_SECRET instead.
+   * You can also use the AUTH0_CLIENT_SECRET environment variable.
    */
   clientSecret?: string;
 
   /**
    * Integer value for the system clock's tolerance (leeway) in seconds for ID token verification.`
    * Default is 60
+   * You can also use the AUTH0_CLOCK_TOLERANCE environment variable.
    */
   clockTolerance: number;
 
   /**
    * Integer value for the http timeout in ms for authentication requests.
    * Default is 5000
+   * You can also use the AUTH0_HTTP_TIMEOUT environment variable.
    */
   httpTimeout: number;
 
   /**
    * To opt-out of sending the library and node version to your authorization server
    * via the `Auth0-Client` header. Default is `true
+   * You can also use the AUTH0_ENABLE_TELEMETRY environment variable.
    */
   enableTelemetry: boolean;
 
   /**
-   * @ignore
-   */
-  errorOnRequiredAuth: boolean;
-
-  /**
-   * @ignore
-   */
-  attemptSilentLogin: boolean;
-
-  /**
-   * Function that returns an object with URL-safe state values for `res.oidc.login()`.
+   * Function that returns an object with URL-safe state values for login.
    * Used for passing custom state parameters to your authorization server.
    * Can also be passed in to {@link HandleLogin}
    *
@@ -207,55 +124,46 @@ export interface Config {
 
   /**
    * Boolean value to log the user out from the identity provider on application logout. Default is `true`
+   * You can also use the AUTH0_IDP_LOGOUT environment variable.
    */
   idpLogout: boolean;
 
   /**
    * String value for the expected ID token algorithm. Default is 'RS256'
+   * You can also use the AUTH0_ID_TOKEN_SIGNING_ALG environment variable.
    */
   idTokenSigningAlg: string;
 
   /**
    * REQUIRED. The root URL for the token issuer with no trailing slash.
    * This is `https://` plus your Auth0 domain
-   * Can use env key ISSUER_BASE_URL instead.
+   * You can also use the AUTH0_ISSUER_BASE_URL environment variable.
    */
   issuerBaseURL: string;
 
   /**
-   * Set a fallback cookie with no SameSite attribute when response_mode is form_post.
-   * Default is true
+   * Set a fallback cookie with no `SameSite` attribute when `response_mode` is `form_post`.
+   * The default `response_mode` for this SDK is `query` so this defaults to `false`
+   * You can also use the AUTH0_LEGACY_SAME_SITE_COOKIE environment variable.
    */
   legacySameSiteCookie: boolean;
 
-  /**
-   * @ignore
-   */
-  authRequired: boolean;
-
   /**
    * Boolean value to automatically install the login and logout routes.
    */
   routes: {
-    /**
-     * @ignore
-     */
-    login: string | false;
-
-    /**
-     * @ignore
-     */
-    logout: string | false;
-
     /**
      * Either a relative path to the application or a valid URI to an external domain.
      * This value must be registered on the authorization server.
      * The user will be redirected to this after a logout has been performed.
+     * You can also use the AUTH0_POST_LOGOUT_REDIRECT environment variable.
      */
     postLogoutRedirect: string;
 
     /**
      * Relative path to the application callback to process the response from the authorization server.
+     * Defaults to `/api/auth/callback`
+     * You can also use the AUTH0_CALLBACK environment variable.
      */
     callback: string;
   };
@@ -271,6 +179,7 @@ export interface SessionConfig {
    * String value for the cookie name used for the internal session.
    * This value must only include letters, numbers, and underscores.
    * Default is `appSession`.
+   * You can also use the AUTH0_SESSION_NAME environment variable.
    */
   name: string;
 
@@ -280,6 +189,7 @@ export interface SessionConfig {
    * duration to be absolute, where the user is logged out a fixed time after login,
    * regardless of activity, set this to `false`
    * Default is `true`.
+   * You can also use the AUTH0_SESSION_ROLLING environment variable.
    */
   rolling: boolean;
 
@@ -287,6 +197,7 @@ export interface SessionConfig {
    * Integer value, in seconds, for application session rolling duration.
    * The amount of time for which the user must be idle for then to be logged out.
    * Default is 86400 seconds (1 day).
+   * You can also use the AUTH0_SESSION_ROLLING_DURATION environment variable.
    */
   rollingDuration: number;
 
@@ -295,6 +206,7 @@ export interface SessionConfig {
    * The amount of time after the user has logged in that they will be logged out.
    * Set this to `false` if you don't want an absolute duration on your session.
    * Default is 604800 seconds (7 days).
+   * You can also use the AUTH0_SESSION_ABSOLUTE_DURATION environment variable.
    */
   absoluteDuration: boolean | number;
 
@@ -309,39 +221,45 @@ export interface SessionConfig {
 export interface CookieConfig {
   /**
    * Domain name for the cookie.
+   * You can also use the AUTH0_COOKIE_DOMAIN environment variable.
    */
   domain?: string;
 
   /**
    * Path for the cookie.
-   *
    * This defaults to `/`
+   * You should change this to be more restrictive if you application shares a domain with other apps.
+   * You can also use the AUTH0_COOKIE_PATH environment variable.
    */
   path?: string;
 
   /**
    * Set to true to use a transient cookie (cookie without an explicit expiration).
    * Default is `false`
+   * You can also use the AUTH0_COOKIE_TRANSIENT environment variable.
    */
   transient: boolean;
 
   /**
    * Flags the cookie to be accessible only by the web server.
    * Defaults to `true`.
+   * You can also use the AUTH0_COOKIE_HTTP_ONLY environment variable.
    */
   httpOnly: boolean;
 
   /**
    * Marks the cookie to be used over secure channels only.
-   * Defaults to the protocol of {@link Config.baseURL}.
+   * Defaults to the protocol of {@link BaseConfig.baseURL}.
+   * You can also use the AUTH0_COOKIE_SECURE environment variable.
    */
   secure?: boolean;
 
   /**
    * Value of the SameSite Set-Cookie attribute.
-   * Defaults to "Lax" but will be adjusted based on {@link AuthorizationParameters.response_type}.
+   * Defaults to "lax" but will be adjusted based on {@link AuthorizationParameters.response_type}.
+   * You can also use the AUTH0_COOKIE_SAME_SITE environment variable.
    */
-  sameSite: boolean | 'lax' | 'strict' | 'none';
+  sameSite: 'lax' | 'strict' | 'none';
 }
 
 /**
@@ -358,10 +276,91 @@ export interface AuthorizationParameters extends OidcAuthorizationParameters {
 }
 
 /**
- * See {@link Config}
+ * @ignore
+ */
+export type NextConfig = Pick<BaseConfig, 'routes' | 'identityClaimFilter'>;
+
+/**
+ * ## Configuration properties.
+ *
+ * The Server part of the SDK can be configured in 2 ways.
+ *
+ * ### 1. Environmental Variables
+ *
+ * The simplest way to use the SDK is to use the named exports ({@link HandleAuth}, {@link HandleLogin},
+ * {@link HandleLogout}, {@link HandleCallback}, {@link HandleProfile}, {@link GetSession}, {@link GetAccessToken},
+ * {@link WithApiAuthRequired} and {@link WithPageAuthRequired}), eg:
+ *
+ * ```js
+ * // pages/api/auth/[...auth0].js
+ * import { handleAuth } from '@auth0/nextjs-auth0';
+ *
+ * return handleAuth();
+ * ```
+ *
+ * When you use these named exports, an instance of the SDK is created for you which you can configure using
+ * environmental variables:
+ *
+ * ### Required
+ *
+ * - `AUTH0_SECRET`: See {@link secret}
+ * - `AUTH0_ISSUER_BASE_URL`: See {@link issuerBaseURL}
+ * - `AUTH0_BASE_URL`: See {@link baseURL}
+ * - `AUTH0_CLIENT_ID`: See {@link clientID}
+ * - `AUTH0_CLIENT_SECRET`: See {@link clientSecret}
+ *
+ * ### Optional
+ *
+ * - `AUTH0_CLOCK_TOLERANCE`: See {@link clockTolerance}
+ * - `AUTH0_HTTP_TIMEOUT`: See {@link httpTimeout}
+ * - `AUTH0_ENABLE_TELEMETRY`: See {@link enableTelemetry}
+ * - `AUTH0_IDP_LOGOUT`: See {@link idpLogout}
+ * - `AUTH0_ID_TOKEN_SIGNING_ALG`: See {@link idTokenSigningAlg}
+ * - `AUTH0_LEGACY_SAME_SITE_COOKIE`: See {@link legacySameSiteCookie}
+ * - `AUTH0_POST_LOGOUT_REDIRECT`: See {@link BaseConfig.routes}
+ * - `AUTH0_CALLBACK`: See {@link BaseConfig.routes}
+ * - `AUTH0_AUDIENCE`: See {@link BaseConfig.authorizationParams}
+ * - `AUTH0_SCOPE`: See {@link BaseConfig.authorizationParams}
+ * - `AUTH0_SESSION_NAME`: See {@link SessionConfig.name}
+ * - `AUTH0_SESSION_ROLLING`: See {@link SessionConfig.rolling}
+ * - `AUTH0_SESSION_ROLLING_DURATION`: See {@link SessionConfig.rollingDuration}
+ * - `AUTH0_SESSION_ABSOLUTE_DURATION`: See {@link SessionConfig.absoluteDuration}
+ * - `AUTH0_COOKIE_DOMAIN`: See {@link CookieConfig.domain}
+ * - `AUTH0_COOKIE_PATH`: See {@link CookieConfig.path}
+ * - `AUTH0_COOKIE_TRANSIENT`: See {@link CookieConfig.transient}
+ * - `AUTH0_COOKIE_HTTP_ONLY`: See {@link CookieConfig.httpOnly}
+ * - `AUTH0_COOKIE_SECURE`: See {@link CookieConfig.secure}
+ * - `AUTH0_COOKIE_SAME_SITE`: See {@link CookieConfig.sameSite}
+ *
+ * ### 2. Create your own instance using {@link InitAuth0}
+ *
+ * If you don't want to configure the SDK with environment variables or you want more fine grained control over the
+ * instance, you can create an instance yourself and use the handlers and helpers from that.
+ *
+ * First, export your configured instance from another module:
+ *
+ * ```js
+ * // utils/auth0.js
+ * import { initAuth0 } from '@auth0/nextjs-auth0';
+ *
+ * export default initAuth0({ ...ConfigParameters... });
+ * ```
+ *
+ * Then import it into your route handler:
+ *
+ * ```js
+ * // pages/api/auth/[...auth0].js
+ * import auth0 from '../../../../utils/auth0';
+ *
+ * return auth0.handleAuth();
+ * ```
+ *
+ * **Note** If you use {@link InitAuth0}, you should *not* use the other named exports as they will use a different
+ * instance of the SDK.
+ *
  * @category Server
  */
-export type ConfigParameters = DeepPartial<Config>;
+export type ConfigParameters = DeepPartial<BaseConfig & NextConfig>;
 
 /**
  * @ignore
@@ -385,7 +384,7 @@ const num = (param?: string): number | undefined => (param === undefined || para
 /**
  * @ignore
  */
-export const getParams = (params?: ConfigParameters): ConfigParameters => {
+export const getConfig = (params?: ConfigParameters): { baseConfig: BaseConfig; nextConfig: NextConfig } => {
   const {
     AUTH0_SECRET,
     AUTH0_ISSUER_BASE_URL,
@@ -417,7 +416,7 @@ export const getParams = (params?: ConfigParameters): ConfigParameters => {
   const baseURL =
     AUTH0_BASE_URL && !/^https?:\/\//.test(AUTH0_BASE_URL as string) ? `https://${AUTH0_BASE_URL}` : AUTH0_BASE_URL;
 
-  return {
+  const baseConfig = getBaseConfig({
     secret: AUTH0_SECRET,
     issuerBaseURL: AUTH0_ISSUER_BASE_URL,
     baseURL: baseURL,
@@ -452,14 +451,23 @@ export const getParams = (params?: ConfigParameters): ConfigParameters => {
         transient: bool(AUTH0_COOKIE_TRANSIENT),
         httpOnly: bool(AUTH0_COOKIE_HTTP_ONLY),
         secure: bool(AUTH0_COOKIE_SECURE),
-        sameSite: bool(AUTH0_COOKIE_SAME_SITE),
+        sameSite: AUTH0_COOKIE_SAME_SITE as 'lax' | 'strict' | 'none' | undefined,
         ...params?.session?.cookie
       }
     },
     routes: {
-      callback: AUTH0_CALLBACK || '/api/auth/callback',
-      postLogoutRedirect: AUTH0_POST_LOGOUT_REDIRECT,
-      ...params?.routes
+      callback: params?.routes?.callback || AUTH0_CALLBACK || '/api/auth/callback',
+      postLogoutRedirect: params?.routes?.postLogoutRedirect || AUTH0_POST_LOGOUT_REDIRECT
     }
+  });
+
+  const nextConfig = {
+    routes: {
+      ...baseConfig.routes
+      // Other NextConfig Routes go here
+    },
+    identityClaimFilter: baseConfig.identityClaimFilter
   };
+
+  return { baseConfig, nextConfig };
 };
diff --git a/src/handlers/callback.ts b/src/handlers/callback.ts
index 2b2c5f27..9d7a6408 100644
--- a/src/handlers/callback.ts
+++ b/src/handlers/callback.ts
@@ -1,6 +1,6 @@
 import { NextApiResponse, NextApiRequest } from 'next';
-import { ClientFactory, Config, callbackHandler, TransientStore } from '../auth0-session';
-import { Session, SessionCache } from '../session';
+import { HandleCallback as BaseHandleCallback } from '../auth0-session';
+import { Session } from '../session';
 import { assertReqRes } from '../utils/assert';
 
 /**
@@ -82,13 +82,7 @@ export type HandleCallback = (req: NextApiRequest, res: NextApiResponse, options
 /**
  * @ignore
  */
-export default function handleLoginFactory(
-  config: Config,
-  getClient: ClientFactory,
-  sessionCache: SessionCache,
-  transientHandler: TransientStore
-): HandleCallback {
-  const handler = callbackHandler(config, getClient, sessionCache, transientHandler);
+export default function handleLoginFactory(handler: BaseHandleCallback): HandleCallback {
   return async (req, res, options): Promise<void> => {
     assertReqRes(req, res);
     return handler(req, res, options);
diff --git a/src/handlers/login.ts b/src/handlers/login.ts
index f9182793..f24145ca 100644
--- a/src/handlers/login.ts
+++ b/src/handlers/login.ts
@@ -1,5 +1,5 @@
 import { NextApiResponse, NextApiRequest } from 'next';
-import { AuthorizationParameters, ClientFactory, Config, loginHandler, TransientStore } from '../auth0-session';
+import { AuthorizationParameters, HandleLogin as BaseHandleLogin } from '../auth0-session';
 import isSafeRedirect from '../utils/url-helpers';
 import { assertReqRes } from '../utils/assert';
 
@@ -36,12 +36,12 @@ export type GetLoginState = (req: NextApiRequest, options: LoginOptions) => { [k
  */
 export interface LoginOptions {
   /**
-   * Override the default {@link Config.authorizationParams authorizationParams}
+   * Override the default {@link BaseConfig.authorizationParams authorizationParams}
    */
   authorizationParams?: Partial<AuthorizationParameters>;
 
   /**
-   *  URL to return to after login, overrides the Default is {@link Config.baseURL}
+   *  URL to return to after login, overrides the Default is {@link BaseConfig.baseURL}
    */
   returnTo?: string;
 
@@ -61,12 +61,7 @@ export type HandleLogin = (req: NextApiRequest, res: NextApiResponse, options?:
 /**
  * @ignore
  */
-export default function handleLoginFactory(
-  config: Config,
-  getClient: ClientFactory,
-  transientHandler: TransientStore
-): HandleLogin {
-  const handler = loginHandler(config, getClient, transientHandler);
+export default function handleLoginFactory(handler: BaseHandleLogin): HandleLogin {
   return async (req, res, options): Promise<void> => {
     assertReqRes(req, res);
     if (req.query.returnTo) {
diff --git a/src/handlers/logout.ts b/src/handlers/logout.ts
index 099e7ad9..02c24cd6 100644
--- a/src/handlers/logout.ts
+++ b/src/handlers/logout.ts
@@ -1,6 +1,5 @@
 import { NextApiResponse, NextApiRequest } from 'next';
-import { ClientFactory, Config, logoutHandler } from '../auth0-session';
-import { SessionCache } from '../session';
+import { HandleLogout as BaseHandleLogout } from '../auth0-session';
 import { assertReqRes } from '../utils/assert';
 
 /**
@@ -11,7 +10,7 @@ import { assertReqRes } from '../utils/assert';
 export interface LogoutOptions {
   /**
    *  URL to returnTo after logout, overrides the
-   *  Default in {@link Config.routes.postLogoutRedirect routes.postLogoutRedirect}
+   *  Default in {@link BaseConfig.routes.postLogoutRedirect routes.postLogoutRedirect}
    */
   returnTo?: string;
 }
@@ -26,12 +25,7 @@ export type HandleLogout = (req: NextApiRequest, res: NextApiResponse, options?:
 /**
  * @ignore
  */
-export default function handleLogoutFactory(
-  config: Config,
-  getClient: ClientFactory,
-  sessionCache: SessionCache
-): HandleLogout {
-  const handler = logoutHandler(config, getClient, sessionCache);
+export default function handleLogoutFactory(handler: BaseHandleLogout): HandleLogout {
   return async (req, res, options): Promise<void> => {
     assertReqRes(req, res);
     return handler(req, res, options);
diff --git a/src/index.ts b/src/index.ts
index 2fbec184..c31f5152 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,4 +1,11 @@
-import { getConfig, CookieStore, TransientStore, clientFactory } from './auth0-session';
+import {
+  CookieStore,
+  TransientStore,
+  clientFactory,
+  loginHandler as baseLoginHandler,
+  logoutHandler as baseLogoutHandler,
+  callbackHandler as baseCallbackHandler
+} from './auth0-session';
 import {
   handlerFactory,
   callbackHandler,
@@ -40,7 +47,7 @@ import {
 } from './helpers';
 import { InitAuth0, SignInWithAuth0 } from './instance';
 import version from './version';
-import { getParams, Config, SessionConfig, CookieConfig, AuthorizationParameters, ConfigParameters } from './config';
+import { getConfig, ConfigParameters } from './config';
 
 let instance: SignInWithAuth0;
 
@@ -53,18 +60,25 @@ function getInstance(): SignInWithAuth0 {
 }
 
 export const initAuth0: InitAuth0 = (params) => {
-  const config = getConfig(getParams(params));
-  const getClient = clientFactory(config, { name: 'nextjs-auth0', version });
-  const transientStore = new TransientStore(config);
-  const cookieStore = new CookieStore(config);
-  const sessionCache = new SessionCache(config, cookieStore);
+  const { baseConfig, nextConfig } = getConfig(params);
+
+  // Init base layer (with base config)
+  const getClient = clientFactory(baseConfig, { name: 'nextjs-auth0', version });
+  const transientStore = new TransientStore(baseConfig);
+  const cookieStore = new CookieStore(baseConfig);
+  const sessionCache = new SessionCache(baseConfig, cookieStore);
+  const baseHandleLogin = baseLoginHandler(baseConfig, getClient, transientStore);
+  const baseHandleLogout = baseLogoutHandler(baseConfig, getClient, sessionCache);
+  const baseHandleCallback = baseCallbackHandler(baseConfig, getClient, sessionCache, transientStore);
+
+  // Init Next layer (with next config)
   const getSession = sessionFactory(sessionCache);
-  const getAccessToken = accessTokenFactory(getClient, config, sessionCache);
+  const getAccessToken = accessTokenFactory(getClient, nextConfig, sessionCache);
   const withApiAuthRequired = withApiAuthRequiredFactory(sessionCache);
   const withPageAuthRequired = withPageAuthRequiredFactory(getSession);
-  const handleLogin = loginHandler(config, getClient, transientStore);
-  const handleLogout = logoutHandler(config, getClient, sessionCache);
-  const handleCallback = callbackHandler(config, getClient, sessionCache, transientStore);
+  const handleLogin = loginHandler(baseHandleLogin);
+  const handleLogout = logoutHandler(baseHandleLogout);
+  const handleCallback = callbackHandler(baseHandleCallback);
   const handleProfile = profileHandler(sessionCache, getClient, getAccessToken);
   const handleAuth = handlerFactory({ handleLogin, handleLogout, handleCallback, handleProfile });
 
@@ -95,10 +109,6 @@ export const handleAuth: HandleAuth = (...args) => getInstance().handleAuth(...a
 export { UserProvider, UserProviderProps, UserProfile, UserContext, useUser } from './frontend';
 
 export {
-  Config,
-  SessionConfig,
-  CookieConfig,
-  AuthorizationParameters,
   ConfigParameters,
   HandleAuth,
   HandleLogin,
diff --git a/src/session/get-access-token.ts b/src/session/get-access-token.ts
index 1bc5e667..1926594d 100644
--- a/src/session/get-access-token.ts
+++ b/src/session/get-access-token.ts
@@ -1,9 +1,10 @@
 import { IncomingMessage, ServerResponse } from 'http';
-import { ClientFactory, Config } from '../auth0-session';
+import { NextApiRequest, NextApiResponse } from 'next';
+import { ClientFactory } from '../auth0-session';
 import { AccessTokenError } from '../utils/errors';
 import { intersect, match } from '../utils/array';
 import { SessionCache, fromTokenSet, fromJson } from '../session';
-import { NextApiRequest, NextApiResponse } from 'next';
+import { NextConfig } from '../config';
 
 /**
  * Custom options to get an Access Token.
@@ -51,7 +52,7 @@ export type GetAccessToken = (
  */
 export default function accessTokenFactory(
   getClient: ClientFactory,
-  config: Config,
+  config: NextConfig,
   sessionCache: SessionCache
 ): GetAccessToken {
   return async (req, res, accessTokenRequest): Promise<GetAccessTokenResult> => {
diff --git a/src/session/session.ts b/src/session/session.ts
index 94e0f4d4..6ad79f6d 100644
--- a/src/session/session.ts
+++ b/src/session/session.ts
@@ -1,5 +1,6 @@
 import { TokenSet } from 'openid-client';
 import { Config } from '../auth0-session';
+import { NextConfig } from '../config';
 
 /**
  * Key-value store for the user's claims.
@@ -56,7 +57,7 @@ export default class Session {
 /**
  * @ignore
  */
-export function fromTokenSet(tokenSet: TokenSet, config: Config): Session {
+export function fromTokenSet(tokenSet: TokenSet, config: Config | NextConfig): Session {
   // Get the claims without any OIDC specific claim.
   const claims = tokenSet.claims();
   config.identityClaimFilter.forEach((claim) => {


Test patch:
diff --git a/tests/auth0-session/client.test.ts b/tests/auth0-session/client.test.ts
index de4ea489..e5b73c4a 100644
--- a/tests/auth0-session/client.test.ts
+++ b/tests/auth0-session/client.test.ts
@@ -11,7 +11,10 @@ const defaultConfig = {
   clientID: '__test_client_id__',
   clientSecret: '__test_client_secret__',
   issuerBaseURL: 'https://op.example.com',
-  baseURL: 'https://example.org'
+  baseURL: 'https://example.org',
+  routes: {
+    callback: '/callback'
+  }
 };
 
 const getClient = (params: ConfigParameters = {}): Promise<Client> =>
diff --git a/tests/auth0-session/config.test.ts b/tests/auth0-session/config.test.ts
index afe8a1de..d21f49d7 100644
--- a/tests/auth0-session/config.test.ts
+++ b/tests/auth0-session/config.test.ts
@@ -1,11 +1,13 @@
-import { Config, ConfigParameters, getConfig, AuthorizationParameters } from '../../src/auth0-session';
-import { DeepPartial } from '../../src/auth0-session/get-config';
+import { Config, ConfigParameters, getConfig, AuthorizationParameters, DeepPartial } from '../../src/auth0-session';
 
 const defaultConfig = {
   secret: '__test_session_secret__',
   clientID: '__test_client_id__',
   issuerBaseURL: 'https://op.example.com',
-  baseURL: 'https://example.org'
+  baseURL: 'https://example.org',
+  routes: {
+    callback: '/callback'
+  }
 };
 
 const validateAuthorizationParams = (authorizationParams: DeepPartial<AuthorizationParameters>): Config =>
@@ -23,25 +25,8 @@ describe('Config', () => {
     });
   });
 
-  it('should get config for default config with environment variables', () => {
-    const _env = process.env;
-    process.env = {
-      ...process.env,
-      ISSUER_BASE_URL: defaultConfig.issuerBaseURL,
-      CLIENT_ID: defaultConfig.clientID,
-      SECRET: defaultConfig.secret,
-      BASE_URL: defaultConfig.baseURL
-    };
-    const config = getConfig();
-    expect(config).toMatchObject({
-      issuerBaseURL: defaultConfig.issuerBaseURL,
-      authorizationParams: {
-        response_type: 'id_token',
-        response_mode: 'form_post',
-        scope: 'openid profile email'
-      }
-    });
-    process.env = _env;
+  it('should throw with empty config', () => {
+    expect(getConfig).toThrow();
   });
 
   it('should get config for response_type=code', () => {
@@ -101,9 +86,7 @@ describe('Config', () => {
   it('should set default route paths', () => {
     const config = getConfig(defaultConfig);
     expect(config.routes).toMatchObject({
-      callback: '/callback',
-      login: '/login',
-      logout: '/logout'
+      callback: '/callback'
     });
   });
 
@@ -112,14 +95,12 @@ describe('Config', () => {
       ...defaultConfig,
       routes: {
         callback: '/custom-callback',
-        login: '/custom-login',
-        logout: '/custom-logout'
+        postLogoutRedirect: '/custom-logout'
       }
     });
     expect(config.routes).toMatchObject({
       callback: '/custom-callback',
-      login: '/custom-login',
-      logout: '/custom-logout'
+      postLogoutRedirect: '/custom-logout'
     });
   });
 
@@ -296,7 +277,7 @@ describe('Config', () => {
         secret: '__test_session_secret__',
         session: {
           cookie: {
-            sameSite: ('__invalid_samesite__' as unknown) as boolean // testing invalid configuration
+            sameSite: ('__invalid_samesite__' as unknown) as any // testing invalid configuration
           }
         }
       })
diff --git a/tests/auth0-session/fixtures/helpers.ts b/tests/auth0-session/fixtures/helpers.ts
index 00195666..c35e8e19 100644
--- a/tests/auth0-session/fixtures/helpers.ts
+++ b/tests/auth0-session/fixtures/helpers.ts
@@ -11,7 +11,10 @@ const clientId = '__test_client_id__';
 export const defaultConfig: Omit<ConfigParameters, 'baseURL'> = {
   secret,
   clientID: clientId,
-  issuerBaseURL: 'https://op.example.com'
+  issuerBaseURL: 'https://op.example.com',
+  routes: {
+    callback: '/callback'
+  }
 };
 
 export const toSignedCookieJar = (cookies: { [key: string]: string }, url: string): CookieJar => {
diff --git a/tests/auth0-session/handlers/logout.test.ts b/tests/auth0-session/handlers/logout.test.ts
index 519ddf75..5273bbb2 100644
--- a/tests/auth0-session/handlers/logout.test.ts
+++ b/tests/auth0-session/handlers/logout.test.ts
@@ -115,7 +115,7 @@ describe('logout route', () => {
 
   it('should redirect to postLogoutRedirect', async () => {
     const postLogoutRedirect = 'https://example.com/post-logout';
-    const baseURL = await setup({ ...defaultConfig, routes: { postLogoutRedirect } });
+    const baseURL = await setup({ ...defaultConfig, routes: { ...defaultConfig.routes, postLogoutRedirect } });
     const cookieJar = await login(baseURL);
 
     const session: SessionResponse = await get(baseURL, '/session', { cookieJar });
diff --git a/tests/config.test.ts b/tests/config.test.ts
index 7207c55c..d4ea8882 100644
--- a/tests/config.test.ts
+++ b/tests/config.test.ts
@@ -1,21 +1,20 @@
-import { getParams } from '../src/config';
-import { ConfigParameters } from '../src';
+import { BaseConfig, NextConfig, getConfig } from '../src/config';
 
-const getParamsWithEnv = (env: any = {}, opts?: any): ConfigParameters => {
+const getConfigWithEnv = (env: any = {}, opts?: any): { baseConfig: BaseConfig; nextConfig: NextConfig } => {
   const bkp = process.env;
   process.env = {
     ...process.env,
     ...{
-      AUTH0_SECRET: undefined,
-      AUTH0_ISSUER_BASE_URL: undefined,
-      AUTH0_BASE_URL: undefined,
-      AUTH0_CLIENT_ID: undefined,
-      AUTH0_CLIENT_SECRET: undefined
+      AUTH0_SECRET: '__long_super_secret_secret__',
+      AUTH0_ISSUER_BASE_URL: 'https://example.auth0.com',
+      AUTH0_BASE_URL: 'https://example.com',
+      AUTH0_CLIENT_ID: '__test_client_id__',
+      AUTH0_CLIENT_SECRET: '__test_client_secret__'
     },
     ...env
   };
   try {
-    return getParams(opts);
+    return getConfig(opts);
   } catch (e) {
     throw e;
   } finally {
@@ -25,69 +24,96 @@ const getParamsWithEnv = (env: any = {}, opts?: any): ConfigParameters => {
 
 describe('config params', () => {
   test('should return an object from empty defaults', () => {
-    expect(getParamsWithEnv()).toStrictEqual({
+    const { baseConfig, nextConfig } = getConfigWithEnv();
+    expect(baseConfig).toStrictEqual({
+      secret: '__long_super_secret_secret__',
+      issuerBaseURL: 'https://example.auth0.com',
+      baseURL: 'https://example.com',
+      clientID: '__test_client_id__',
+      clientSecret: '__test_client_secret__',
+      clockTolerance: 60,
+      httpTimeout: 5000,
+      enableTelemetry: true,
+      idpLogout: true,
       auth0Logout: true,
+      idTokenSigningAlg: 'RS256',
+      legacySameSiteCookie: true,
       authorizationParams: {
-        audience: undefined,
         response_type: 'code',
-        scope: undefined
-      },
-      baseURL: undefined,
-      clientID: undefined,
-      clientSecret: undefined,
-      clockTolerance: undefined,
-      httpTimeout: undefined,
-      enableTelemetry: undefined,
-      idTokenSigningAlg: undefined,
-      idpLogout: true,
-      issuerBaseURL: undefined,
-      legacySameSiteCookie: undefined,
-      routes: {
-        callback: '/api/auth/callback',
-        postLogoutRedirect: undefined
+        audience: undefined,
+        scope: 'openid profile email'
       },
-      secret: undefined,
       session: {
-        absoluteDuration: undefined,
+        name: 'appSession',
+        rolling: true,
+        rollingDuration: 86400,
+        absoluteDuration: 604800,
         cookie: {
           domain: undefined,
-          httpOnly: undefined,
           path: '/',
-          sameSite: undefined,
-          secure: undefined,
-          transient: undefined
-        },
-        name: undefined,
-        rolling: undefined,
-        rollingDuration: undefined
-      }
+          transient: false,
+          httpOnly: true,
+          secure: true,
+          sameSite: 'lax'
+        }
+      },
+      routes: { callback: '/api/auth/callback', postLogoutRedirect: '' },
+      getLoginState: expect.any(Function),
+      identityClaimFilter: [
+        'aud',
+        'iss',
+        'iat',
+        'exp',
+        'nbf',
+        'nonce',
+        'azp',
+        'auth_time',
+        's_hash',
+        'at_hash',
+        'c_hash'
+      ],
+      clientAuthMethod: 'client_secret_basic'
+    });
+    expect(nextConfig).toStrictEqual({
+      identityClaimFilter: [
+        'aud',
+        'iss',
+        'iat',
+        'exp',
+        'nbf',
+        'nonce',
+        'azp',
+        'auth_time',
+        's_hash',
+        'at_hash',
+        'c_hash'
+      ],
+      routes: { callback: '/api/auth/callback', postLogoutRedirect: '' }
     });
   });
 
   test('should populate booleans', () => {
     expect(
-      getParamsWithEnv({
+      getConfigWithEnv({
         AUTH0_ENABLE_TELEMETRY: 'off',
         AUTH0_LEGACY_SAME_SITE_COOKIE: '0',
         AUTH0_IDP_LOGOUT: 'no',
-        AUTH0_SESSION_ROLLING: false,
         AUTH0_COOKIE_TRANSIENT: true,
         AUTH0_COOKIE_HTTP_ONLY: 'on',
-        AUTH0_COOKIE_SAME_SITE: 'yes',
+        AUTH0_COOKIE_SAME_SITE: 'lax',
         AUTH0_COOKIE_SECURE: 'ok',
-        AUTH0_SESSION_ABSOLUTE_DURATION: 'yes'
-      })
+        AUTH0_SESSION_ABSOLUTE_DURATION: 'no'
+      }).baseConfig
     ).toMatchObject({
       auth0Logout: false,
       enableTelemetry: false,
       idpLogout: false,
       legacySameSiteCookie: false,
       session: {
-        rolling: false,
-        absoluteDuration: true,
+        absoluteDuration: false,
         cookie: {
           httpOnly: true,
-          sameSite: true,
+          sameSite: 'lax',
           secure: true,
           transient: true
         }
@@ -97,17 +123,17 @@ describe('config params', () => {
 
   test('should populate numbers', () => {
     expect(
-      getParamsWithEnv({
+      getConfigWithEnv({
         AUTH0_CLOCK_TOLERANCE: '100',
         AUTH0_HTTP_TIMEOUT: '9999',
         AUTH0_SESSION_ROLLING_DURATION: '0',
         AUTH0_SESSION_ABSOLUTE_DURATION: '1'
-      })
+      }).baseConfig
     ).toMatchObject({
       clockTolerance: 100,
       httpTimeout: 9999,
       session: {
-        rolling: undefined,
+        rolling: true,
         rollingDuration: 0,
         absoluteDuration: 1
       }
@@ -116,39 +142,39 @@ describe('config params', () => {
 
   test('passed in arguments should take precedence', () => {
     expect(
-      getParamsWithEnv(
+      getConfigWithEnv(
         {},
         {
           authorizationParams: {
             audience: 'foo',
-            scope: 'bar'
+            scope: 'openid bar'
           },
-          baseURL: 'baz',
+          baseURL: 'https://baz.com',
           routes: {
             callback: 'qux'
           },
           session: {
-            absoluteDuration: 'quux',
+            absoluteDuration: 100,
             cookie: {
-              transient: 'quuux'
+              transient: false
             },
             name: 'quuuux'
           }
         }
-      )
+      ).baseConfig
     ).toMatchObject({
       authorizationParams: {
         audience: 'foo',
-        scope: 'bar'
+        scope: 'openid bar'
       },
-      baseURL: 'baz',
+      baseURL: 'https://baz.com',
       routes: {
         callback: 'qux'
       },
       session: {
-        absoluteDuration: 'quux',
+        absoluteDuration: 100,
         cookie: {
-          transient: 'quuux'
+          transient: false
         },
         name: 'quuuux'
       }
@@ -157,20 +183,22 @@ describe('config params', () => {
 
   test('should allow hostnames as baseURL', () => {
     expect(
-      getParamsWithEnv({
+      getConfigWithEnv({
         AUTH0_BASE_URL: 'foo.auth0.com'
-      })
+      }).baseConfig
     ).toMatchObject({
       baseURL: 'https://foo.auth0.com'
     });
   });
 
   test('should accept optional callback path', () => {
-    expect(
-      getParamsWithEnv({
-        AUTH0_CALLBACK: '/api/custom-callback'
-      })
-    ).toMatchObject({
+    const { baseConfig, nextConfig } = getConfigWithEnv({
+      AUTH0_CALLBACK: '/api/custom-callback'
+    });
+    expect(baseConfig).toMatchObject({
+      routes: expect.objectContaining({ callback: '/api/custom-callback' })
+    });
+    expect(nextConfig).toMatchObject({
       routes: expect.objectContaining({ callback: '/api/custom-callback' })
     });
   });
diff --git a/tests/fixtures/default-settings.ts b/tests/fixtures/default-settings.ts
index dd1a5182..64cb4689 100644
--- a/tests/fixtures/default-settings.ts
+++ b/tests/fixtures/default-settings.ts
@@ -5,7 +5,10 @@ export const withoutApi: ConfigParameters = {
   clientID: '__test_client_id__',
   clientSecret: 'client_secret',
   baseURL: 'http://www.acme.com/',
-  secret: '__test_session_secret__'
+  secret: '__test_session_secret__',
+  routes: {
+    callback: '/api/auth/callback'
+  }
 };
 
 /**
@@ -20,5 +23,8 @@ export const withApi: ConfigParameters = {
   authorizationParams: {
     scope: 'openid profile read:customer',
     audience: 'https://api.acme.com'
+  },
+  routes: {
+    callback: '/api/auth/callback'
   }
 };
diff --git a/tests/session/session.test.ts b/tests/session/session.test.ts
index f2c9a125..5b845683 100644
--- a/tests/session/session.test.ts
+++ b/tests/session/session.test.ts
@@ -1,7 +1,7 @@
 import { TokenSet } from 'openid-client';
 import { fromJson, fromTokenSet } from '../../src/session';
 import { makeIdToken } from '../auth0-session/fixtures/cert';
-import { Config, Session } from '../../src';
+import { Session } from '../../src';
 
 describe('session', () => {
   test('should construct a session with a user', async () => {
@@ -11,8 +11,9 @@ describe('session', () => {
   test('should construct a session from a tokenSet', () => {
     expect(
       fromTokenSet(new TokenSet({ id_token: makeIdToken({ foo: 'bar', bax: 'qux' }) }), {
-        identityClaimFilter: ['baz']
-      } as Config).user
+        identityClaimFilter: ['baz'],
+        routes: { callback: '', postLogoutRedirect: '' }
+      }).user
     ).toEqual({
       aud: '__test_client_id__',
       bax: 'qux',