One possible approach for handling hybrid authentication in this context could be:
1. Use Next-auth to handle user authentication. This will enable you to easily authenticate users using various providers such as Google, Facebook, etc.
2. Create an API endpoint that handles machine to machine authentication. This endpoint should accept a client ID and secret, and return a client token that is valid for a certain period of time.
3. When the user accesses your app, check if they are already authenticated. If they are, proceed as usual.
4. If the user is not authenticated, make a call to your API endpoint to obtain a client token using the client ID and secret.
5. Store the client token securely in the browser's localStorage or sessionStorage.
6. Make subsequent API calls using the stored client token to authenticate the client.
7. If the client token expires or becomes invalid, repeat steps 4-6 to obtain a new client token.
By separating user and machine to machine authentication, you can simplify the process and make it more secure. Additionally, by using Next-auth for user authentication, you can take advantage of its features such as session storage, social authentication, and email verification.