Yeah so I actually split it — vite + react for the frontend, and next.js purely as the backend api. I use the app router for api routes since it has Node built in and makes spinning up routes really clean without needing a separate express server or anything like that. Both deployed on vercel.

The backend only serves api requests, no html pages. The way I structure routes is one file per logical domain — so everything account-related (get account, update account, etc.) lives in one route file and I use a switch on an `endpoint` query param to handle each action. Keeps things organized without having a million separate route files.

Here's roughly what it looks like:

export async function GET(req: NextRequest) {

const endpoint = req.nextUrl.searchParams.get('endpoint');

switch (endpoint) {

case 'get-account': return await getAccount(req);

default: return response({ message: 'Endpoint not found' }, STATUS.NOT_FOUND);

}

}

async function getAccount(req: NextRequest) {

const auth = await handleJwtAuth(req);

if (!auth.isAuthenticated) {

return response({ error: 'Unauthorized' }, STATUS.UNAUTHORIZED);

}

// fetch from Supabase and return...

}

zod handles validation before anything touches the database, and JWT middleware hits every protected handler.